Cross-site Scripting (XSS) - Stored in zikula/core


Reported on

Jan 17th 2022


In zikula/core cross site scripting vulnerability is present in block modules block list description field. This commit e453ad not properly santize the input.

Proof of Concept

login to the demo account

go to blocks

Add payload in block list description field and save

4 .payload = "><iMg SrC="x" oNeRRor="alert(1);">

5 . Click position like left,right or any, it go to this link and alert will trigger.

We are processing your report and will contact the zikula/core team within 24 hours. a year ago
We have contacted a member of the zikula/core team and are waiting to hear back a year ago
Axel Guckelsberger validated this vulnerability a year ago
Asura-N has been awarded the disclosure bounty
The fix bounty is now up for grabs
Axel Guckelsberger marked this as fixed in 3.0.5 with commit 4f4d5d a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation