Stored HTML Injection via Company Name in alextselegidis/easyappointments
Mar 8th 2023
easyappointments present an html injection vulnerability on the company name field on "/index.php/backend/settings" page.
- login as admin
- go to /index.php/backend/settings Page
- insert the payload in Company Name field
- go back to the home page and see the result.
Proof of Concept
//Payload ------><a href="https://google.com"> CLICKHERE</a> <------
i hope i was helpful.
*. A stored HTML injection attack occurs when an attacker injects malicious HTML code into legitimate HTML code of a web application.
*. This vulnerability can lead to various types of attacks, including open redirects, phishing attempts, and browser hijacking.
*. Additionally, an attacker can gain access to the victim's IP address, latitude and longitude, and potentially carry out a camera phishing attack.
*. Overall, a stored HTML injection vulnerability can have severe consequences and it is important to prevent and mitigate this type of attack.