Resumes Management and Job Application Website version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.
5a76ff65b5062f277ac950783306e48497b8baa33d0e9df6700a77c318e130c8
# Exploit Title: Multiple Stored XSS in
Resumes-management-and-job-application-website
# Date: 2/1/2021
# Exploit Author: Saswat Subhajyoti Mallick
# Vendor Homepage: https://egavilanmedia.com/
# Software Link:
https://egavilanmedia.com/resumes-management-and-job-application-website/
# Version: 1.0
# Tested on: windows 10/wamp
Attacker can put stored xss and gain admin access unauthenticated .
For stored XSS poc
simply put <script>alert(1)</script> in first name,last name and
address field while applying for resume.
Stored XSS will be activated the moment admin user logs in.