Description

When adding a menu after logging in with an administrator account, there is no verification of the URL value, so the XSS payload is stored in the DB. After that, when you click the saved menu, XSS is triggered. (If an administrator adds a menu, normal users can click it too.)

Proof of Concept

1. Open the https://www.admidio.org/demo_en
2. Log in as administrator
3. Go to https://www.admidio.org/demo_en/adm_program/modules/menu/menu_new.php
4. Fill in the field and pass javascript:alert(document.domain) as the URL value.
5. Click Saved Menu

Video : https://youtu.be/rvopFkFlfuw

Impact

Through this vulnerability, an attacker is capable to execute malicious scripts.