Online Inventory Manager 3.2 - Persistent Cross-Site Scripting

vendor:

Online Inventory Manager

by:

Cemal Cihad ÇIFTÇI

N/A

CVSS

N/A

Cross-site Scripting

CWE

Product Name: Online Inventory Manager

Affected Version From: 3.2

Affected Version To: 3.2

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 Pro

2019

Online Inventory Manager 3.2 – Persistent Cross-Site Scripting

Stored XSS has been discovered in the Online Inventory Manager created by bigprof/AppGini. The vulnerability exists in the editgroups section where an attacker can inject malicious JavaScript code into the description field. This code will be executed when viewing the groups page. The vulnerability also exists when creating a new group.

Mitigation:

To mitigate this vulnerability, the vendor should implement input validation and sanitization techniques to prevent the execution of arbitrary JavaScript code. Users should also be cautious when interacting with the affected software and avoid entering any untrusted data.

Source

Exploit-DB raw data:

# Exploit Title: Online Inventory Manager 3.2 - Persistent Cross-Site Scripting
# Date: 2019-11-29
# Exploit Author: Cemal Cihad ÇİFTÇİ
# Vendor Homepage: https://bigprof.com
# Software Link : https://bigprof.com/appgini/applications/online-inventory-manager
# Software : Online Inventory Manager
# Version : 3.2
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# Tested on: Windows 10 Pro

# Stored XSS has been discovered in the Online Inventory Manager created by bigprof/AppGini
# editgroups section. In editgroups section
# (http://localhost/inventory/admin/pageEditGroup.php?groupID=1).

# Payload i used:
"><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>"

# POC: http://localhost/inventory/admin/pageViewGroups.php in this
# url you can edit the groups information with pressing onto the group name. After the edit page open
# you can enter your payload into the description field. After going back to
# the groups page you will see your Javascript code gonna run.
# This vulnerability is also exist while you are creating a new group.