Description

Cross-site scripting (XSS) is a common attack vector that injects malicious code into a vulnerable web application. Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.

Proof of Concept

1. Login as Normal user.
2. Click on Options and select user.
3. Set title as <script>alert(document.domain)</script> and save. It will store the XSS payload.
4. log in to any account, i.e. admin.
5. Click on the top right corner i.e EditUser executing xss.

Video PoC

EditUser- https://drive.google.com/file/d/1zHI5GNU7JFUL5h6e64tnUFg4lXzqECRU/view?usp=sharing
EditProducto- https://drive.google.com/file/d/1Z2fcc6DF-4eFpB1DAok3XMrtjUtYWo5M/view?usp=sharing