CVE-2021-42664 - Stored Cross-Site Scripting vulnerability in the Engineers online portal system.
A stored XSS vulnerability exists in the Engineers online portal system. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more.
Affected components -
Vulnerable page - add_quiz.php
Vulnerable parameters - "quiz_title", "description"
- Navigate to http://localhost/nia_munoz_monitoring_system/add_quiz.php
- Insert your payload in the "quiz_title" parameter or the "description" parameter
- Click save
The following payload will allow you to run the javascript code -
<script>alert("This is an XSS")</script>
https://www.exploit-db.com/exploits/50451
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42664
https://nvd.nist.gov/vuln/detail/CVE-2021-42664
Alon Leviev(0xDeku), 22 October, 2021.