Daily Expense Tracker System 1.0 Cross Site Scripting

Daily Expense Tracker System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 0e08e14a829972ebeb29e414ec300463

Download

# Exploit Title: Daily Expense Tracker System Stored Cross-Site Scripting
Vulnerability
# Date: 2021-01-26
# Exploit Author: Priyanka Samak
# Vendor Homepage: https://phpgurukul.com/
# Software Link:
https://phpgurukul.com/daily-expense-tracker-using-php-and-mysql/
# Software: : Daily Expense Tracker System # Version : 1.0
# Vulnerability Type: Cross-site Scripting
# Vulnerability: Stored XSS
# Tested on Windows 10
# This application is vulnerable to Stored XSS vulnerability.
# Vulnerable script:
1) http://localhost/dets/user-profile.php
2)http://localhost/dets/add-expense.php
# Vulnerable parameters: ‘Full Name' and 'Item’
# Payload used: <script>alert(‘document.cookie’)</script>
# POC: When you view the details under the Manage Expense tab and User
Profile tab
# You will see your Javascript code executes.


Thanks and Regards, Priyanka Samak

Source: packetstormsecurity.com