Stored XSS via name parameter of "Predefined Properties" in pimcore/pimcore
Mar 21st 2023
It's observed that the name parameter of the "Predefined Properties" functionality is vulnerable to stored XSS.
Proof of Concept
1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Settings -> Predefined Properties -> Add and Enter the payload: ```"><img src=1 onerror=alert(document.domain)>``` inside the name input field. 3.Then click on update. 4.Now delete the name, you will see XSS will trigger.
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
Please add it to the above report as an occurrence. Opening more than 1 report per vulnerability type by circumventing our bundling system can result in a ban.
Hi @psmoros i have updated the report
https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3/ and added this as occurrence
@dvesh3 @maintainer Now please validate the report and the occurrences.
@admin how can i find the published CVE for this fix? thanks!
@admin please help
Hi, the CVE is assigned and will update to published shortly. Thanks!