COVID-19 Testing Management System 1.0 Cross Site Scripting

`# Exploit Title: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)  
# Date: 11/06/2021  
# Exploit Author: BHAVESH KAUL  
# Vendor Homepage: https://phpgurukul.com  
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/  
# Version: 1.0  
# Tested on: Server: XAMPP  
  
# Description #  
  
COVID19 Testing Management System 1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitization. Anyone can submit a stored XSS payload without login when registering as a new user. This makes the application store our payload in the database and it is fired everything the dashboard is viewed.  
  
# Proof of Concept (PoC) : Exploit #  
  
1) Goto: http://localhost/covid-tms/new-user-testing.php  
2) Enter the following payload in 'State' parameter: <script>alert(1)</script>  
3) Fill out other information and submit query  
4) Now goto: http://localhost/covid-tms/live-test-updates.php  
5) Stored XSS payload is fired  
  
# Image PoC : Reference Image #  
  
1) Vulnerable Parameter: https://ibb.co/1vyNM2w  
2) Payload Fired: https://ibb.co/CsfPnXK  
`