Skip to content

Latest commit

 

History

History
25 lines (16 loc) · 891 Bytes

CVE-2023-37070-Exploit.md

File metadata and controls

25 lines (16 loc) · 891 Bytes
Raw

Description

Code Projects Hospital Information System 1.0 is vulnerable to Sotre Cross-Site Scripting (XSS)


Exploit Title: Hospital Information System V1.0 - Store XSS

Exploit Author: Ritesh Sahu

Vendor Homepage: https://code-projects.org/

Software Link: https://code-projects.org/hospital-information-system-in-php-with-source-code/

Tested on: Linux

Steps to Reproduce

  1. Visit:- http://localhost/HIS/src/index/index.php
  2. Login with the admin user and password.
  3. Go to add user:- http://localhost/HIS/src/users/addUser.php
  4. Add a new user using XSS Payloads.
  5. After Adding a new user logout admin user and login admin user.
  6. Go to add user:- http://localhost/HIS/src/users/addUser.php
  7. Now the XSS payload is working.