Savsoft Quiz 5 Cross Site Scripting

`# Exploit Title: Savsoft Quiz 5 - 'field_title' Stored Cross-Site Scripting  
# Date: 2020-09-02  
# Exploit Author: Dhruv Patel(dhruvp111296)  
# Vendor Homepage: https://savsoftquiz.com/  
# Software Link: https://github.com/savsofts/savsoftquiz_v5.git  
# Version: 5.0  
# Tested on: Windows 10  
  
Attack vector:  
This vulnerability can results attacker to inject the XSS payload in admin  
panel Custom Field section. And Inject JavaScript Malicious code & Steal  
User’s cookie  
  
Vulnerable Parameters: title  
Steps for reproduce:  
1. Go to admin panel’s add custom fields page  
2. Fill the Title name as <script>alert("HELLO XSS")</script> payload in title.  
3. Now Click on Save we can see our payload gets executed.  
4. All Users Can Show our Payload As a xss.  
  
`