Persistent Cross Site Scripting - WidgetsManagement Module - Settings in yetiforcecompany/yetiforcecrm
Aug 19th 2022
Proof of Concept
- 1- Login to the application
- 2- Access the WidgetsManagement Module via the following URL:
- 3-Click to the button "Edit chart from filter". Change the value of "title" parameter with the following payload:
Widgets" onfocus="alert(document.domain)" autofocus ""="
**Inject the payload