Royal Event Management System - Stored Cross-Site Scripting

What is the "Royal Event Management System - Stored Cross-Site Scripting?"

The "Royal Event Management System - Stored Cross-Site Scripting" module is designed to detect a stored cross-site scripting vulnerability in the Royal Event Management System. This vulnerability allows an attacker to execute arbitrary scripts in the browser of an unsuspecting user. The severity of this vulnerability is classified as high.

This module was authored by ritikchaddha.

Impact

A successful exploitation of the stored cross-site scripting vulnerability in the Royal Event Management System can lead to various consequences, including:

- Execution of arbitrary scripts in the browser of an unsuspecting user - Potential theft of sensitive user information - Possible manipulation of website content - Compromise of user accounts

How the module works?

The "Royal Event Management System - Stored Cross-Site Scripting" module works by sending a specific HTTP request to the target system and then matching the response against predefined conditions. If the conditions are met, the module reports the vulnerability.

Here is an example of the HTTP request used by the module:

POST /royal_event/companyprofile.php HTTP/1.1
Host: <Hostname>

companyname=><script>alert(document.domain)</script>&regno=test&companyaddress=&companyemail=&country=India&mobilenumber=1234567899&submit=

The module includes the following matching conditions:

- A matcher that checks if the response contains the string value="><script>alert(document.domain)</script>"> - A matcher that checks if the response status is 302 (Found)

If both matching conditions are met, the module reports the presence of the stored cross-site scripting vulnerability in the Royal Event Management System.