Faculty Evaluation System 1.0 - Stored XSS

vendor:

Faculty Evaluation System using PHP/MySQLi with Source Code

by:

Vijay Sachdeva (pwnshell)

3.1

CVSS

MEDIUM

Stored XSS

CWE

Product Name: Faculty Evaluation System using PHP/MySQLi with Source Code

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:faculty_evaluation_system_using_phpmysqli_with_source_code

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux

2020

Faculty Evaluation System 1.0 – Stored XSS

A stored XSS vulnerability exists in the Faculty Evaluation System 1.0 application. An attacker can exploit this vulnerability by logging in to the application with admin credentials, clicking on Questionnaires, then clicking 'Action' for any Academic Year and then clicking manage. The attacker can then input a malicious script in the 'Question' field of the Question form and click 'Save'. This will trigger the stored XSS payloads. Whenever the attacker clicks on Questionnaires, clicks action for any academic year, and then manage, the XSS payloads will be triggered for that 'Academic Year'.

Mitigation:

Input validation should be used to prevent malicious scripts from being stored in the application. Additionally, the application should be configured to use a Content Security Policy (CSP) to prevent the execution of malicious scripts.

Source

Exploit-DB raw data:

# Exploit Title: Faculty Evaluation System 1.0 - Stored XSS
# Exploit Author: Vijay Sachdeva (pwnshell)
# Date: 2020-12-22
# Vendor Homepage: https://www.sourcecodester.com/php/14635/faculty-evaluation-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14635&title=Faculty+Evaluation+System+using+PHP%2FMySQLi+with+Source+Code
# Tested on Kali Linux

Step 1: Log in to the application with admin credentials

Step 2: Click on Questionnaires, then click "Action" for any Academic Year
and then click manage.

Step 3. Input "<script>alert("pwnshell")</script>" in "Question" field of
the Question form.

Step 4. Click on "Save" when done and this will trigger the Stored XSS
payloads. Whenever you click on Questionnaires, click action for any
academic year, and then manage,  your XSS Payloads will be triggered for
that "Academic Year"