Interview Management System 1.0 - Stored XSS in Add New Question

vendor:

Interview Management System

by:

Saeed Bala Ahmed (r0b0tG4nG)

7.5

CVSS

HIGH

Stored XSS

CWE

Product Name: Interview Management System

Affected Version From: Version 1

Affected Version To: Version 1

Patch Exists: NO

Related CWE: N/A

CPE: a:sourcecodester:interview_management_system:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Parrot OS

2020

Interview Management System 1.0 – Stored XSS in Add New Question

Log in to the application with any valid user credentials. Click on Add New Question Page. Input <script>alert(document.cookie)</script> in the new question field and select add new question. Once you have an XSS payload as a question in add new question page, click on View Questions Page. This will trigger the XSS payload.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: Interview Management System 1.0 - Stored XSS in Add New Question
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-09
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14585/interview-management-system-phpmysqli-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14585&title=Interview+Management+System+in+PHP%2FMySQLi+with+Full+Source+Codee
# Affected Version: Version 1
# Patched Version: Unpatched
# Category: Web Application
# Tested on: Parrot OS

Step 1: Log in to the application with any valid user credentials.

Step 2: Click on Add New Question Page.

Step 3: input "<script>alert(document.cookie)</script>" in the new question
field and select add new question.

Step 4: Once you have an XSS payload as a question in add new question
page, click on View Questions Page.

Step 5: This will trigger the XSS payload.