Cross-site Scripting (XSS) - Stored in leantime/leantime
Sep 2nd 2021
A malicious actor is able to add
New Project with a malicious payload, and upon opening the research menu, the XSS payload is being executed.
🕵️♂️ Proof of Concept
1; Log in with a proper roled user
2; Add a new Project to the system at the
/projects/showAll/ URI with the
+ New Project button
3; Insert the following payload in the name field:
4; Open the List of the projects at the
/projects/showAll URI, and the xss payload is being executed.
With such opprotunity, the malicious actor is able to gather session identifiers from any users. Upon receiving this information, the Confidentiality, Integrity is compromised of the target's account.