Cross-site Scripting (XSS) - Stored in imran300/inventoryValid
Aug 19th 2021
Stored xss bug using a xss payload in the product name when adding a new categorie in the product page.
🕵️♂️ Proof of Concept
Goto http://localhost/inventory/index.php/Category/list_category and click on add category and copy paste the following xss payload and paste it in the CATEGORY NAME
"><img src=x onerror=alert(document.cookie)>
Click on safe and see the xss popup with the cookie.
Possible to steal admin cookies or take over another account via cookie grepping.
Validate user input