Exploit Title: SOPlanning v1.52.00 'groupe_save.php' XSS (Reflected XSS)  
Application: SOPlanning  
Version: 1.52.00  
Date: 4/22/24  
Exploit Author: Joseph McPeters (Liquidsky)  
Vendor Homepage:  
Software Link:  
Tested on: Linux  
CVE: Not yet assigned  
Description: SOPlanning v1.52.00 is vulnerable to XSS via the 'groupe_id' parameters a remote unautheticated attacker can hijack the admin account or other users. The remote attacker can hijack a users session or credentials and perform a takeover of the entire platform.  
Example Payload:  
Reflected XSS: /soplanning/www/process/groupe_save.php?saved=1&groupe_id="><script>alert('LiQUiDSKY')</script><!--&nom=Project+New  
Analysis: The landing page takes into consideration the user input then redirects to a page where the XSS is shown the payload included in the exploit, escapes the variable where it is held, and comments out the rest to perform a valid reflected XSS attack against any authenticated user the payload was sent to.