Description

Stored cross site scripting vulnerability in Save grid option in pimcore dashboard.

Proof of Concept

1. Login to the demo account https://11.x-dev.pimcore.fun/admin/login

2. On left side menu go to document --> perspective --> cdp https://11.x-dev.pimcore.fun/admin/?perspective=CDP

3. it will take you to customers data select any customer data eg: 1020 or 5020

4. Now go to dashboard select Grid option drop down select save as copy,

5. Add name as "><iMg SrC="x" oNeRRor="alert(1);">

6. click save and check the grip options alert will pop up

// PoC.js

var payload = "><iMg SrC="x" oNeRRor="alert(1);">

Impact

The attacker is capable to stolen the user session cookie. it will leads to complete account takeover.