Description

XSS found on function add Group Name on User Management module at Organizr (2.1.1810).

Proof of Concept

1. Go to User Management -> Manage Group
2. Add new group
3. Insert payload on "Group Name" field then Add Group

Payload

1. "><script >alert("xss-here");</script>

Screenshot

1. xss-triger
2. version
3. document cookie

Impact

This vulnerability is capable of executing a malicious javascript code in web page and stealing user's session and also obtain sensitive information.