Pizza Inn Registration Stored XSS

vendor:

Pizza Inn

by:

Kenneth F. Belva

7,5

CVSS

HIGH

Stored XSS

CWE

Product Name: Pizza Inn

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: CVE-2014-6619

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

Pizza Inn Registration Stored XSS

On registration the XSS code will be stored in the database. When the administrator views the new sign-ups it will execute.

Mitigation:

Input validation and output encoding can be used to prevent XSS attacks.

Source

Exploit-DB raw data:

Title:     Pizza Inn Registration Stored XSS
Severity:   High
CVE-ID:   CVE-2014-6619
Release Date:  20 September 2014 
Author:   Kenneth F. Belva
Websites:  http://silverbackventuresllc.com
    http://xssWarrior.com 
    http://securitymaverick.com
Twitter:   @infosecmaverick
Contact:  Please use website contact form.
Mail: 
URL:     http://sourceforge.net/projects/restaurantmis/
Vendor: 
Remote Exploit:  Yes

Discovered with: xssWarrior - http://xssWarrior.com


Description:
============

On registration the XSS code will be stored in the database. When the administrator views the new sign-ups it will execute.


Proof of Concept :
==================

http://[domain]/PizzaInn/register-exec.php
fname=[code]&lname=[code]&login=[code]&password=r00t&cpassword=r00t&question=8&answer=hack4&Submit=Register