CVE-2023-39707

CVE-2023-39707

Exploit Title: Free and Open Source inventory management system php source code -XSS Cross Site Scripting 
Vendor of product: https://www.sourcecodester.com
Software Link: https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.html
Tested On: Linux
Attack type: Local

Steps to Reproduce -

1. Visit http://localhost/ample/login.php

2. Click on the "Register" button to navigate to the Registration page.

3.  After clicking on "Register" we redirect to URL: http://localhost/ample/index.php?page=dashboard

4. go to expense section  http://localhost/ample/index.php?page=expense and add new

5. Use payload: "><script>alert(123)</script> 

6. Click on add Expense

7. Click on Submit Use XSS payload ( "><script>alert(123)</script> ) put payload in add new

8. It reflected the value of 123.

Reference: CVE-2023-39707