Tag Archives: Stored Cross-site Scripting (XSS)

[CVE-2021-28424] Teachers Record Management System 1.0 – ‘email’ Stored Cross-site Scripting (XSS) vulnerability (Authenticated)

# Exploit Author: nhattruong.blog# Referrer: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28424https://www.exploit-db.com/exploits/50019https://packetstormsecurity.com/files/163171/Teachers-Record-Management-System-1.0-Cross-Site-Scripting.html# Version: 1.0# Tested on: Windows 10 + XAMPP v3.2.4POC: Go to url http://localhost/admin/index.php Do login Execute the payload Reload page to see the different The entry point in ’email’ POST parameter in admin/adminprofile.php Payload: