CVE-2023-34650: Common-Vulnerabilities-and-Exposures/CVE-2023-34650 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

# Small CRM v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

## Stored Cross Site Scripting Vulnerability found in Small CRM v.1.0

Vulnerability Description -

The Small CRM v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1. Visit the Small CRM v.1.0 application by accessing the URL: http://localhost/crm/index.php

2. Click on the “User Sign Up” and Creat New User Account

“Name” field, inject the following XSS payload, enclosed in brackets: {"><script>alert(“XSS”)</script>}.

3. Click on the “Submit” button.

4. Login to the User account using the Email id and Password Which You Have Entered, injected payload will be executed.

5. Also Login Through Admin Account, Click on Users Option

6. Refresh the page, and the injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application’s database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text “XSS.” This allows the attacker to execute arbitrary code within the user’s browser, potentially leading to further attacks or unauthorized actions.

**Reference: CVE-2023-34650**