Headline
CVE-2022-29380: Offensive Security’s Exploit Database Archive
Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.
# Exploit Title: Academy-LMS 4.3 - Stored XSS
# Date: 19/12/2020
# Vendor page: https://academy-lms.com/
# Version: 4.3
# Tested on Win10 and Google Chrome
# Exploit Author: Vinicius Alves
# XSS Payload: "><h1>STORED XSS</h1> (Scripts tag blocked)
1) Access LMS and log in to admin panel
2) Access courses page
3) Open course manager and SEO menu
4) Paste the XSS Payload tag and Submit
5) Access the course page on frontend
6) Exploited!