Cross-Site Scripting (XSS) vulnerabilities in Client Management System Version 1.2

Client_Management_System_1.2_XSS.txt

# Exploit Title: Reflected Cross Site Scripting (XSS)
# Date: 19/10/2024
# Exploit Author: Esquire
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/client-management-system-using-php-mysql/
# Version: 1.2 
# Tested on: Kali Linux
# CVE : CVE-2024-51209

# Description #

Client Management System 1.2 is vulnerable to reflected cross site scripting because we can inject a script tag inside the search input field and affect what user sees on the page

# Proof of Concept (PoC) : Exploit #

1) Go to: http://localhost/clientms/admin/search-invoices.php or http://localhost/clientms/client/search-invoices.php
2) Login as admin using test credentials: admin/Test@123  or as client: abc@gmail.com/Test
3) Go to: http://localhost/clientms/admin/admin-profile.php
4) Enter the following payload in the search input field: '<script>alert('XSS')</script>' or '<script>alert(1)</script>'
5) Next click the search button to enter the script
6) If the web application is vulnerable, it will execute the script and display an alert box with the message "XSS" or "1".