Advertisement






Employee Record Management System 1.2 - 'Multiple' Stored Cross Site Scripting (xss) in Ed

CVE Category Price Severity
CVE-2019-15107 CWE-79 $500 High
Author Risk Exploitation Type Date
Unknown High Remote 2021-07-09
Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021070061

Below is a copy:

Employee Record Management System 1.2 - 'Multiple' Stored Cross Site Scripting (xss) in Edit My Education Option
# Exploit Title: Employee Record Management System 1.2 - 'Multiple' Stored Cross Site Scripting (xss) in Edit My Education Option
# Date: 09 July 2021
# Exploit Author: Subhadip Nag (mrl0s3r)
# Author Linkedin: www.linkedin.com/in/subhadip-nag-09/
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/
# Tested on: Server: XAMPP

# Description #

Employee Record Management System 1.2 is vulnerable to stored cross site scripting (xss) in the Edit My Education because of insufficient user supplied data.


# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/ERMSP/erms/loginerms.php
2) Login: Login as a User(given username and password)
3) Go To Edit My Education and Edit My Exp
4) Enter the payload: <script>alert(1)</script>
5) Click Update
6) Go to 'My Education' option
7) Our XSS attack successful

# PoC image
1) https://ibb.co/LS78xjX
2) https://ibb.co/9G0Pbxb

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.