Stored XSS — PARK TICKETING MANAGEMENT SYSTEM(Phpgurukul)

# Exploit Title: PARK TICKETING MANAGEMENT SYSTEM — Stored XSS Vulnreability.
# Date: 25–01–2023
# Exploit Author: Venkata Siva Kumar Medituru
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/park-ticketing-management-system-using-php-and-mysql/
# Vulnerable Parameter : Admin Name
# Version: 1.0
# Tested on: Windows 10
# Contact: https://www.linkedin.com/in/shivakumar-m-v/

XSS is an attack technique that injects malicious code into vulnerable web applications. Unlike other attacks, this technique does not target the web server itself, but the user’s browser.

Stored XSS is a type of XSS that stores malicious code on the application server. Using stored XSS is only possible if your application is designed to store user input.

The Reproducive Steps are given in Video PoC.

Remediation :

01) Use Web Application Firewall.

02) Input validation.