Cross-site Scripting (XSS) - Stored in zikula/core

Valid

Reported on

Nov 29th 2021

Description

In zikula/core cross site scripting vulnerability is present in block module title field

Proof of Concept

  1. login to the demo account

  2. go to blocks https://demo.ziku.la/blocks/admin/view

  3. Add payload in title field and save

4 payload = "><iMg SrC="x" oNeRRor="alert(1);">

Impact

This vulnerability is capable of stolen the user session

We are processing your report and will contact the zikula/core team within 24 hours. 2 years ago
We have contacted a member of the zikula/core team and are waiting to hear back 2 years ago
A zikula/core maintainer validated this vulnerability 2 years ago
Asura-N has been awarded the disclosure bounty
The fix bounty is now up for grabs
A zikula/core maintainer marked this as fixed in 3.0.4 with commit e453ad 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation