Description

The name parameter of the "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes" functionality is vulnerable to Stored XSS.

Proof of Concept

1.Login to https://demo.pimcore.fun/admin/.

2.Now go to Online Shop -> Pricing Rules -> Add and  Enter the name of the new item.

3.Then capture the request on the burp suite and modify the name parameter value with xss payload: ```"><img src=1 onerror=alert(1337);> or "><img src=1 onerror=alert(document.domain);>``` and forward the request.

4.Now xss will trigger.

Video PoC

https://drive.google.com/file/d/1caoStWr0Ex08j0cmqCSiwyjpCQgYSR6j/view?usp=share_link
https://drive.google.com/file/d/1vChnkWZKoNYjn_1HBFsFVDGbo_x1vUjS/view?usp=share_link
https://drive.google.com/file/d/1WNdLQ-vjcfPWG4k24MMBkknTocPgCSLB/view?usp=share_link
https://drive.google.com/file/d/1kQjTzLNpuzZRySUt19IBn3T7ABvMRxem/view?usp=share_link

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.