Description

Please enter a description of the vulnerability. Cross Site Scripting (XSS) in UrlSlug of pimcore/pimcore

Its Different than https://huntr.dev/bounties/75bc7d07-46a7-4ed9-a405-af4fc47fb422/

Proof of Concept

1. Login in stable account URL : https://11.x-dev.pimcore.fun/admin/
2. Go to System Data ---> UrlSlug
3. Enter Payload in UrlSlug with starting with "/" slash.
4. then go to Content-Master Document , Enter Random Value in Document. 
5. Save & Publish and Hit Apply 
6. Go to SEO & Setting.
For more understanding please check POC.
// PoC.js
var payload = /"><img src=x onerror=alert(document.domain);>
POC : https://drive.google.com/file/d/1Akm1vYR0Por2hD0TWFvIfQLqJDfiO0bT/view?usp=sharing

Impact

An attacker can use XSS to send a malicious script to an unsuspecting user.