Lost And Found Information System 1.0 Cross Site Scripting

`# Exploit Title: Stored Cross Site Scripting Exploit - Lost and Found Information System   
# Exploit Author: Amit Roy (Rezur / AR0x7)  
# Date: June 07, 2024  
# Vendor Homepage: https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html  
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-lfis.zip  
# Tested on: Kali Linux, Apache, Mysql  
# Version: v1.0  
# Exploit Description:  
# Lost and Found Information System v1.0 suffers from a Stored Cross Site Scripting Vulnerability allowing authenticated attackers to execute javascript in context of other users including the admin  
# CVE : CVE-2024-37856  
  
1) Go to the User Profile page  
2) Paste the XSS payload '<script>alert(document.cookie)</script>' in either of the first, last, middle name fields  
3) The payload will be triggered in the context of the admin or the other users# Exploit Title: Refelcted Cross Site Scripting Exploit - Lost and Found Information System   
`