Description

Here FolderName field is vulnerable to HTML injection, a malicious user could potentially rename a folder with a payload containing malicious code. This could result in an attack on the admin who edits the folder, as the payload could execute upon the admin's interaction with the folder. This attack could potentially allow the attacker to gain unauthorized access to the admin's system or steal sensitive information, or it can force admin to get redirected on attacker website.

Proof of Concept

https://drive.google.com/file/d/1RZjHRZiTPcdIU4qR1cmwL3Tv2f9qVar9/view?usp=sharing

Impact

Malicious users could potentially exploit the vulnerability in the label field of an item to carry out an HTML injection attack, which could redirect other users to an attacker's website or capture their sensitive data through a form. This could result in a variety of negative consequences, including the theft of confidential information, financial loss, and reputational damage to the affected users or organizations. Additionally, the attack could spread further, affecting other users who interact with the compromised item or website, leading to a wider breach of security.