Restaurant Script (PizzaInn Project) - Stored XSS

🗓️ 29 Sep 2014 00:00:00Reported by RootType

Pizza Inn Registration Stored XSS - Stored XSS vulnerability in Pizza Inn registration allows execution of malicious code upon administrator viewing new sign-ups

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2014-6619	30 Sep 201416:00	–	cve
Cvelist	CVE-2014-6619	30 Sep 201416:00	–	cvelist
Exploit DB	Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting	24 Sep 201400:00	–	exploitdb
EUVD	EUVD-2014-6498	7 Oct 202500:30	–	euvd
exploitpack	Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting	24 Sep 201400:00	–	exploitpack
NVD	CVE-2014-6619	30 Sep 201416:55	–	nvd
Packet Storm	Pizza Inn Registration Cross Site Scripting	21 Sep 201400:00	–	packetstorm
Prion	Cross site scripting	30 Sep 201416:55	–	prion


                                                Title:     Pizza Inn Registration Stored XSS
Severity:   High
CVE-ID:   CVE-2014-6619
Release Date:  20 September 2014
Author:   Kenneth F. Belva
Websites:  http://silverbackventuresllc.com
    http://xssWarrior.com
    http://securitymaverick.com
Twitter:   @infosecmaverick
Contact:  Please use website contact form.
Mail:
URL:     http://sourceforge.net/projects/restaurantmis/
Vendor:
Remote Exploit:  Yes
 
Discovered with: xssWarrior - http://xssWarrior.com
 
 
Description:
============
 
On registration the XSS code will be stored in the database. When the administrator views the new sign-ups it will execute.
 
 
Proof of Concept :
==================
 
http://[domain]/PizzaInn/register-exec.php
fname=[code]&amp;lname=[code]&amp;login=[code]&amp;password=r00t&amp;cpassword=r00t&amp;question=8&amp;answer=hack4&amp;Submit=Register

29 Sep 2014 00:00Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.02904