# Exploit Title: Seat Reservation System 1.0 Persistent Cross-Site Scripting # Date: 10-08-2020 # Exploit Author: George Tsimpidas # Vendor Homepage: www.sourcecodester.com # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php_0.zip # Version: 1.0 # Tested on: Ubuntu 18.04.5 LTS (Bionic Beaver) # Category: Webapp Description : The file movie_list.php does not sanitize correctly the description drop down menu on the edit mode, therefore it echoes out the data on the parsed ID number of the current indicated movie. Culprit : ######################################################################### <div class="dropdown-menu"> <a class="dropdown-item edit_movie" href="javascript:void(0)" data-id = '<?php echo $row['id'] ?>'>Edit</a> ######################################################################### PoC : 1. Navigate on the admin panel and login : http://localhost/seat_reservation/admin/ 2. Go under the category Movie List 3. Click on Edit, and change the description of the Movie "The Matrix" 4. Apply on the description the below payload : <script>alert("XSS")</script> 5. Click save, and visit the main menu : http://localhost/seat_reservation/ 6. Locate the movie " The Matrix " and click Reserve Seat You will be granted with a Cross Site Scripting Alert.