CVE-2021–44114.

Stored Cross Scripting through add user function

Discovered by Nithissh S

Vulnerable version: 1.0

Vendor Homepage:

Stock Management System in PHP/OOP with Source Code

Bug Description:

Stored XSS Vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows remote malicious users to execute arbitrary code execution via create user function.

Steps to Reproduce:

1. First off all there is a functionality in this application that has a admin we can add the users and the function is vulnerable to persistent/stored cross site scripting
2. Now we can add the XSS payload as “><body/onload=alert(1)> in the First name field

First name field

3. After creating the new user , The XSS will get triggered and javascript will get executed

XSS will get popped up

Impact:

This vulnerability has the potential to steal a user’s cookie and gain unauthorized access to that user’s account through the stolen cookie.

CVE-Mitre:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44114