Stored XSS on user "Edit own profile" function in admidio/admidio
Jun 18th 2023
An attacker can inject malicious executable scripts into the code of the Social media field
Proof of Concept
Log in as a Member user, access My profile -> Edit own profile function, insert this payload to any field
" autofocus onfocus=prompt(document.domain)> then click Save.
Access the Edit own profile function again and the payload will be triggered.
It also affects the administrator if he accesses the user profile by the link of the user.
Since the cookie used for sessions was set with the "HTTPonly" attribute, so the attacker can not hijack user sessions but still can carry out some malicious actions by manipulating XSS vulnerabilities, such as:
- Users are being redirected to a malicious website.
- Capturing keystrokes from users.
- Obtaining access to a user’s browsing history and clipboard contents.
- Execution of web browser-based exploits (e.g., crashing the browser).
- Influencing the users to submit requests to a server controlled by the attacker.
- Modifying the page’s content.
- Using deception to trick the victim into disclosing their password to the application or other applications.
- Using a security vulnerability in the web browser, infecting the victim with other malicious code, and potentially taking over the victim’s computer.