Pizza Inn Registration Cross Site Scripting

🗓️ 21 Sep 2014 00:00:00Reported by Kenneth F. BelvaType

packetstorm🔗 packetstormsecurity.com👁 27 Views

Pizza Inn Registration Stored XSS, CVE-2014-6619, High Severity, XSS Stored in Databas

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2014-6619	30 Sep 201416:00	–	cve
Cvelist	CVE-2014-6619	30 Sep 201416:00	–	cvelist
Exploit DB	Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting	24 Sep 201400:00	–	exploitdb
EUVD	EUVD-2014-6498	7 Oct 202500:30	–	euvd
exploitpack	Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting	24 Sep 201400:00	–	exploitpack
NVD	CVE-2014-6619	30 Sep 201416:55	–	nvd
Prion	Cross site scripting	30 Sep 201416:55	–	prion
seebug.org	Restaurant Script (PizzaInn Project) - Stored XSS	29 Sep 201400:00	–	seebug

`Title: Pizza Inn Registration Stored XSS  
Severity: High  
CVE-ID: CVE-2014-6619  
Release Date: 20 September 2014   
Author: Kenneth F. Belva  
Websites: http://silverbackventuresllc.com  
http://xssWarrior.com   
http://securitymaverick.com  
Twitter: @infosecmaverick  
Contact: Please use website contact form.  
Mail:   
URL: http://sourceforge.net/projects/restaurantmis/  
Vendor:   
Remote Exploit: Yes  
  
Discovered with: xssWarrior - http://xssWarrior.com  
  
  
Description:  
============  
  
On registration the XSS code will be stored in the database. When the administrator views the new sign-ups it will execute.  
  
  
Proof of Concept :  
==================  
  
http://[domain]/PizzaInn/register-exec.php  
fname=[code]&lname=[code]&login=[code]&password=r00t&cpassword=r00t&question=8&answer=hack4&Submit=Register  
  
  
`

21 Sep 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7

EPSS0.02904