Description

The value for the stufftype parameter is reflected in the web context without proper filtering in place resulting in possibility to execute malicious javascript code.

Testing Environment

1. Windows OS
2. Firefox Browser

Proof of Concept

1. Visit https://demo.corebos.com/index.php?module=Home&action=HomeAjax&file=NewBlock&stuffid=test;&stufftype=%22%20onmouseover=%22alert(1)%22%20test=%22
2. Hover over the Refresh icon displayed in the page to execute the payload.

Impact

The attacks commonly include transmitting private data, like cookies or other session information, to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user’s machine under the guise of the vulnerable site.