Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user

Proof of Concept

1.Go to https://11.x-dev.pimcore.fun/admin/ and login.
2.Then go the Document Edit page.
3.Click on properties button
4.In parameter text filed inject Xss payload `><img src=x onerror=alert(document.domain);>`
5.Click on save button and you can see Xss are triggered.


POC LINK : https://drive.google.com/file/d/1y9JVccNm0MxKqHZ-Fii_lSt5YZwB67ir/view?usp=sharing

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.