Description

grav-plugin-admin 1.10.25 has a Stored-XSS vulnerability that is executed when metadata information of a file whose name contains javascript are shown.

Proof of Concept

1 - After installing grav+admin browse to http://127.0.0.1/admin/pages/home.

2 - Create a file named as follows: <script>alert()</script>.png

3 - In the page media section select the file created at the point 2. The file is uploaded and is visible in the page media area.

4 - Everytime the admin hover the mouse pointer on the picture and clicks on the metadata icons the javascript code injected in the filename is executed.

Impact

This vulnerability is capable of executing arbitrary javascript in the victim's browser.