Cross-site Scripting (XSS) - Stored in eventum/eventum
Reported on
Nov 10th 2021
Description
Multiple Stored XSS in Administration at eventum 3.10.8
Proof of Concept
// PoC.payload
"><iMg SrC="x" oNeRRor="alert(1);">
Step to Reproduct
Goto Administration Areas and choose to feature below
Manage News
Input payload into field[Title]
Manage Status
Input payload into field[Title]
Manage Projects
Input payload into field[Title]
Manage Releases
Input payload into field[Title]
Manage Categories
Input payload into field[Title]
Manage Priorities
Input payload into field[Title]
Manage Severities
Input payload into field[Title] and field[Description]
Manage Phone Support Categories
Input payload into field[Title]
Manage Time Tracking Categories
Input payload into field[Title]
Manage Users
Input payload into field[Full Name ]
Manage Groups
Input payload into field[Title] and and field[Description]
Manage Issue Resolutions
Input payload into field[Title]
Manage Canned Email Responses
Input payload into field[Title]
Manage Link Filters
Input payload into field[Description]
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie.
Recomendation
Add | escape:"html" for the points listed in the Occurrences section since it is possible to prevent triggering the stored xss from the functions listed in the Step to Reproduct section.
Occurrences
References
SECURITY.md exists
2 years ago
