Description

I recently found a bypass for external links that allows an attacker to inject javascript into external links

Proof of Concept

As an admin user

Go to /front/link.form.php?id=1

Using a special character before the javascript:alert(1) this bypasses the filters and the protocol still works

copy and paste the character HERE

Replace the X by the special character

Create an external link and put has value for the payload Xjavascript:alert(1)

Assign this link to budgets (example)

As a regular user

Go to /front/budget.form.php?id=1

Click on the links tab

Move the mouse over the link

XSS triggered

Impact

This vulnerability would potentially allow attackers to hijack the user's current session, steal relevant information, deface the website or direct users to malicious websites, and there is even the possibility of escalating the level of exploitation or more advanced attacks (for example, create privileged users ).