Description

During testing the pimcore application, I found that it is vulnerable to XSS vulnerability in Predefined Properties module in Settings, specifically at Name field.

Proof of Concept

1.Go to https://11.x-dev.pimcore.fun/admin/ then login.
2.Go to Settings -> Predefined Properties and add a new property.
3.Change the New Property to the payload "><img src=x onerror=alert(document.domain);> at the Name field.
4.Click on delete icon (X) of that property, you will see the XSS popup triggers.

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.