Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-3949 — XSS in Simple Cashiering System | Kitploit
Tools/GitHubGitHub/maikroservice/cve-2022-3949
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubmaikroservice/cve-2022-3949

CVE-2022-3949

XSS in Simple Cashiering System

View Repository
13 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-3949

XSS in Simple Cashiering System

Simple Cashiering System is vulnerable to Cross Site Scripting (XSS) - a malicious actor can change the fullname of a compromised user to a XSS Payload and whenever a admin visits the user-tab or the sales tab (and looks into sales made by the malicious actor) the payload is triggered. This can lead to session takeover because the cookie does not have an HttpOnly Flag.

How-to Reproduce:

  • Download https://www.sourcecodester.com/php/14945/simple-cashiering-system-pos-php-and-sqlite-source-code-free-download.html
  • setup web server with php + sqlite3 and copy the application to the webserver
  • login as user and change your fullname to
  • login as an admin user and visit the user tab of the admin dashboard
  • XSS is triggered step1
step2
Download Tool