CVE-2023-34647: Common-Vulnerabilities-and-Exposures/CVE-2023-34647 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

# Hostel Management System v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

## Stored Cross Site Scripting Vulnerability found in Hostel Management System v.1.0

Vulnerability Description -

The Hostel Management System v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1. Visit the Hostel Management System v.1.0 application by accessing the URL: http://localhost/hostel/index.php.

2. Click on the “Sign Up” and Creat New User Account

“First Name” “Last Name” field, inject the following XSS payload, enclosed in brackets: {"><script>alert(“XSS”)</script>}.

3. Click on the “Submit” button.

4. Login to the Account using the Email id and Password Which You Have Entered, injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application’s database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text “XSS.” This allows the attacker to execute arbitrary code within the user’s browser, potentially leading to further attacks or unauthorized actions.

**Reference: CVE-2023-34647**