resumes management and job application website 1.0 multiple stored xss

				
# Exploit Title: Resumes Management and Job Application Website 1.0 - Multiple Stored XSS
# Date: 2/1/2021
# Exploit Author: Saswat Subhajyoti Mallick
# Vendor Homepage: https://egavilanmedia.com/
# Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/
# Version: 1.0
# Tested on: windows 10/wamp

Attacker can put stored xss and gain admin access unauthenticated .
For stored XSS poc simply put <script>alert(1)</script> in first name,last name and address field while applying for resume.

Stored XSS will be activated the moment admin user logs in.
            
				

Resumes management and job application website 1.0 multiple stored xss Vulnerability / Exploit Source : Resumes management and job application website 1.0 multiple stored xss