Shuttle Booking Software 2.0 Cross Site Scripting

Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023110014

Below is a copy:

Shuttle Booking Software 2.0 Cross Site Scripting

# Exploit Title: Shuttle Booking Software v2.0 - Multiple Stored Cross-Site
Scripting (Authenticated)
# Date: 09/11/2023
# Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)
# Vendor Homepage: https://www.phpjabbers.com/shuttle-booking-software/
# Software Link: https://www.phpjabbers.com/shuttle-booking-software/
# Version: v2.0
# Tested on: Windows 10, Kali Linux
# CVE: CVE-2023-48172

Descriptions:
Cross Site Scripting vulnerability in Shuttle Booking Software v.2.0 allows
a remote attacker to execute arbitrary code via the name, description,
title and address parameters in the index.php page.


Steps to Reproduce:
1. At first login your panel.
2. Then use any XSS Payload in "name, description, title and address"
parameters in Location, Lines and Users menus.
3. You will see XSS pop up.

## Reproduce:
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48172)

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.