Description

Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Steps to reproduce [it works on Firefox (not in chromium based browsers)]

1.Go to https://www.rosariosis.org/demonstration/ and login with administrator account

2.Go to https://www.rosariosis.org/demonstration/Modules.php?modname=Resources/Resources.php

3.Create new link with content javascriptjavascript::alert(origin)

4.Click the link and observe a pop up

#Image POC

https://drive.google.com/file/d/1eAp3e2iScNtD80UNEgnNc905c55Z-PsC/view?usp=sharing

https://drive.google.com/file/d/1pDFNzxA_b_ib9SvAyo9vbTr3SrSphTnB/view?usp=sharing

Impact

User clicking the link can be affected by malicious javascript code created by the attacker.