Cross-site Scripting (XSS) - Stored in imran300/inventory
Aug 19th 2021
Stored xss bug using a xss payload in the employee name when adding a new employee
🕵️♂️ Proof of Concept
Goto http://localhost/inventory/employees/add_employee and click on add employee and copy paste the following xss payload and paste it in the EMP NAME
"><img src=x onerror=alert(document.cookie)>
Click on safe and see the xss popup with the cookie.
Possible to steal admin cookies or take over another account via cookie grepping.
Validate user input