Description

rosariosis is vulnerable to Stored XSS in the File upload in Assignments by uploading an xHTML file with the javascript code inside.

Proof of Concept

phish.xhtml

<?xml version="1.0"?>
<html:html xmlns:html='http://www.w3.org/1999/xhtml'>
<html:script>
alert(document.domain);
</html:script>
</html:HTML>

Step to reproduce

From attacker side (student)

1.Login to the demo environment by student account (student/student)
2.In the left menu, go to GRADES -> Assignments
3.Click on Add and subtract assignment
4.Click Choose file and upload the phish xHTML file above
5.Click on SUBMIT ASSIGNMENT

From victim side (teacher)

1.Login to the demo environment by teacher account (teacher/teacher)
2.In the left menu, go to GRADES -> Grades
3.Click on Student S Student student
4.Click View online in the Submission column
5.Click on Download link and you will see the XSS is triggered

Impact

This vulnerability has the potential to phish user to another page and trick user to steal cookies and gain unauthorized access to that user's account through the stolen cookies.