Multiple stored XSS in answerdev/answer
Reported on
Jan 24th 2023
Description
Hello! Found multiple stored XSS.
PoCs
"About me" XSS
Insert this code (<image src =q onerror=prompt(1337)>) in "About me" (http://host/users/settings/profile)
Website title XSS
go to /admin/general, edit 'Site Name' adding the following payload <script>alert("XSS ATTACK!")</script>
The script will be executed every time you reload the page.
Answers XSS
[a](javascript:alert(1)) will be sanitized, but [a](JaVaScRiPt:alert(1)) wont. Also <javascript:prompt(document.cookie)>
Post a a comment using the previus payload: [a](JaVaScRiPt:alert(1))
Impact
An attacker could execute JavaScript code in the victim browser, leading to e.g. cookie stealing
Thank you for confirming. Is there anything else I can assist you with at this time?
This report is related to two bugs. One of them has been fixed in the current version, and the other will be fixed in the next version. @admin can you help us assign a CVE to this report? And we will make it public in the next release version.
Hey @maintainer, you have the option to assign a CVE, you will see this option during the fix and publishing stage.
