User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS

vendor:

User Registration & Login and User Management System With admin panel

by:

yusufmalikul

8.8

CVSS

HIGH

Persistent XSS

CWE

Product Name: User Registration & Login and User Management System With admin panel

Affected Version From: 2.1

Affected Version To: 2.1

Patch Exists: NO

Related CWE: N/A

CPE: 2.3:a:phpgurukul:user_registration_&_login_and_user_management_system_with_admin_panel:2.1

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10

2020

User Registration & Login and User Management System With admin panel 2.1 – Persistent XSS

User Registration & Login and User Management System With admin panel 2.1 application from PHPgurukul is vulnerable to Persistent XSS via the fname, lname, email, and contact field name when user register on the site then admin viewing user list on manage user page triggering the payload.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS
# Google Dork: N/A
# Date: 2020-08-07
# Exploit Author: yusufmalikul
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 2.1
# Tested on: Windows 10
# CVE : N/A

Description

User Registration & Login and User Management System With admin panel 2.1 application from PHPgurukul is vulnerable to
Persistent XSS via the fname, lname, email, and contact field name when user register on the site then admin viewing user
list on manage user page triggering the payload.

POC

User side
1. Go to the user registration page http://localhost/loginsystem
2. Enter <img src="x" onerror=alert(document.cookie)> in one of the field (first name, last name, email, or contact)
3. Click sign up

Admin side
1. Login to admin panel http://localhost/loginsystem/admin
2. After login successful it will redirect to manage user page
3. Payload triggered