COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)

vendor:

COVID19 Testing Management System

by:

BHAVESH KAUL

8,8

CVSS

HIGH

Stored Cross-Site-Scripting (XSS)

CWE

Product Name: COVID19 Testing Management System

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:phpgurukul:covid19_testing_management_system

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Server: XAMPP

2021

COVID19 Testing Management System 1.0 – ‘State’ Stored Cross-Site-Scripting (XSS)

COVID19 Testing Management System 1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitization. Anyone can submit a stored XSS payload without login when registering as a new user. This makes the application store our payload in the database and it is fired everything the dashboard is viewed.

Mitigation:

Input validation and sanitization should be implemented to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)
# Date: 11/06/2021
# Exploit Author: BHAVESH KAUL
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Server: XAMPP

# Description #

COVID19 Testing Management System 1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitization. Anyone can submit a stored XSS payload without login when registering as a new user. This makes the application store our payload in the database and it is fired everything the dashboard is viewed.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/covid-tms/new-user-testing.php
2) Enter the following payload in 'State' parameter: <script>alert(1)</script>
3) Fill out other information and submit query
4) Now goto: http://localhost/covid-tms/live-test-updates.php
5) Stored XSS payload is fired

# Image PoC : Reference Image #

1) Vulnerable Parameter: https://ibb.co/1vyNM2w
2) Payload Fired: https://ibb.co/CsfPnXK