Description

easyappointments present an html injection vulnerability on the company name field on “/index.php/backend/settings” page.

Steps:

1. login as admin
2. go to /index.php/backend/settings Page
3. insert the payload in Company Name field
4. go back to the home page and see the result.

Proof of Concept

//Payload
------&gt;<a href="https://google.com"> CLICKHERE</a> &lt;------

i hope i was helpful.