Description

The name parameter of the "Static Routes" functionality is vulnerable to stored XSS.

Proof of Concept

1.Login to https://demo.pimcore.fun/admin/.

2.Now go to Marketing -> Customers Reports -> Add and Enter the name of the new item (a-zA-Z-_).

3.Then capture the request on the burp suite and modify the name parameter value with xss payload: ```"><img src=1 onerror=alert(1337)> or "><img src=1 onerror=alert(document.domain)>``` and forward the request.

4.Now xss will trigger.

Video PoC

https://drive.google.com/file/d/1WNdLQ-vjcfPWG4k24MMBkknTocPgCSLB/view?usp=share_link

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.