Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting

What is the "Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting?"

The "Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting" module is designed to detect cross-site scripting vulnerabilities in the Senayan Library Management System version 9.4.0 (SLIMS 9). This module targets the SLIMS 9 software and helps identify potential security risks related to cross-site scripting.

This module has a medium severity level, indicating that the detected vulnerability could potentially be exploited to compromise the security of the system.

This module was authored by arafatansari.

Impact

Cross-site scripting (XSS) vulnerabilities can allow attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and the execution of arbitrary code on the affected system.

How the module works?

The "Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting" module works by sending a specific HTTP request to the target system and analyzing the response for potential vulnerabilities. It checks if the response contains the following conditions:

- The response body contains the string "<script>alert(document.domain)</script>" and the string "SLiMS". - The response headers contain the string "text/html". - The response status code is 200.

If all of these conditions are met, the module reports a potential cross-site scripting vulnerability in the SLIMS 9 software.

Here is an example of the HTTP request used by this module:

GET /index.php?_csrf_token_645a83a41868941e4692aa31e7235f2=6a50886006f02202a6dac5cfa07bcbfb1e2a6e84&destination=zbuip%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3Ejgoihbmmygljgoihbmmygl&logMeIn=Login&memberID=admin&memberPassWord=password&p=member HTTP/1.1
Host: [target_host]

Please note that this is a technical module designed for security testing purposes and should only be used with proper authorization.