Cross-site Scripting (XSS) - Stored in eventum/eventum
Reported on
Nov 10th 2021
Description
Multiple Stored XSS in Administration at eventum 3.10.8
Proof of Concept
// PoC.payload
"><iMg SrC="x" oNeRRor="alert(1);">
Step to Reproduct
Goto Administration Areas and choose to feature below
Manage News
Input payload into field[Title]
Manage Status
Input payload into field[Title]
Manage Projects
Input payload into field[Title]
Manage Releases
Input payload into field[Title]
Manage Categories
Input payload into field[Title]
Manage Priorities
Input payload into field[Title]
Manage Severities
Input payload into field[Title] and field[Description]
Manage Phone Support Categories
Input payload into field[Title]
Manage Time Tracking Categories
Input payload into field[Title]
Manage Users
Input payload into field[Full Name ]
Manage Groups
Input payload into field[Title] and and field[Description]
Manage Issue Resolutions
Input payload into field[Title]
Manage Canned Email Responses
Input payload into field[Title]
Manage Link Filters
Input payload into field[Description]
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie.
Recomendation
Add | escape:"html" for the points listed in the Occurrences section since it is possible to prevent triggering the stored xss from the functions listed in the Step to Reproduct section.
Occurrences
References
