Description

pimcore is vulnerable to XSS at Abbreviation and Longname fields in Quantity Value of Data Objects module in Settings.

Payload

"><img src=x onerror=alert(document.domain);>

Proof of Concept

1.Go to https://11.x-dev.pimcore.fun/admin/ and login.
2.In the left menu bar, go to Settings -> Data Objects -> Quantity Value.
3.In the QuantityValue Unit Definition tab, and click on Add button then input any text into the Unique identifier field then click OK to add a new record.
4.Input the payload "><img src=x onerror=alert(document.domain);> into the Abbreviation or Longname fields of the new added record then click Update.
You will see the XSS popup triggers.

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.