CVE-2020-25270 PoC — PHPGurukul Hostel Management System 跨站脚本漏洞

Description

PHPGurukul hostel-management-system 2.1 allows XSS via  Guardian Name, Guardian Relation,  Guardian Contact no,  Address, City

Readme

# CVE-2020-25270
PHPGurukul hostel-management-system 2.1 allows XSS via  Guardian Name, Guardian Relation,  Guardian Contact no,  Address, City

#Vendor - PHPGurukul

#Product -https://phpgurukul.com/hostel-management-system V2.1

#Vulnerability Type - Cross Site Scripting (XSS)

#Addition Information - XSS will be triggered in both side, user can escalate of admin privilege through stealing admin cookies.

#Affected Component - Books > New Book ,[ http:///lms/index.php?page=books] http:///lms/index.php?page=books

#Attack Type- Local

#Privilege Escalation - true

#Impact Code execution - true

> Attack Vector
> --------------
>
>  Install Hostel Management System V 2.1
>
>
> ***1) User Module***
> ------------------
>
> Login as user and go to "Book Hostel" (http:/localhost/hostel/book-hostel.php) and start booking.

>
> Add malicious script in these fields - "<script>alert('XSS');</script>"
> 
>  i.  Guardian Name

>  ii. Guardian Relation

>  iii.Guardian Contact no

>  iv. Address

>  vi. City

> 
> After that will get a prompt "Student Successfully register" and after pressing "See All", XSS will be triggered.




> 
> ***2) Admin Module***
> ------------------
>
> Login in as Admin and go to "Management Students", and "View Full details" of booked student's record, XSS will be triggered also.

File Snapshot

Remarks