Description

pimcore is vulnerable to XSS at Name field in Classification Store of Data Objects module in Settings. The vulnerability exists in all 3 tabs: Group Collections, Group, Key Definitions.

Payload

"><img src=x onerror=alert(document.domain);>

Proof of Concept

1.Go to https://11.x-dev.pimcore.fun/admin/ and login.
2.In the left menu bar, go to Settings -> Data Objects -> Classification Store and click on ProductAttributes.
3.In the new open tab, click on Add button, then input the payload "><img src=x onerror=alert(document.domain);> into the Name field then click OK.
4.Click on delete icon (X) on that new added record, you will see the XSS popup triggers.
Note: The vulnerability exists in all 3 tabs: Group Collections, Group, Key Definitions.

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.