Reflected XSS on the login page

[manisashank]

Hi Team,

I couldn't find any contact information of @gamonoid on their github profile page so creating an issue here.

Description:
IceHRM application is vulnerable to Reflected cross-site Scripting vulnerability. This is due to the application not properly sanitizing the user input in next parameter on the login page.

Steps to reproduce:

1. Visit the below URL from firefox: https://icehrm.com/app/<any_nickname>/login.php?next=testingforbugs%22%20accesskey=%22x%22%20onclick%3d%22alert(document.domain)
2. Once the above page loads click ALT+SHIFT+X (Windows) or CTRL+ALT+X (OS X)

References:
https://portswigger.net/research/xss-in-hidden-input-fields

POC: