Reflected XSS - Uploads section

[joelvadodil]

Hi team,

There is a reflected XSS issue in the "uploads" section in version 3.3.7. When we pass the payload in the folder name section the payload gets executed and the folder gets created.

Payload - ><img src=x onerror=alert(document.cookie); >.jpg

Please check and close this issue.

Reference:

[tablatronix]

wow, i had no idea jquery selectors were injectable. wtf ( at least this is fixed in newer versions )

newfolder is evaluated here!
$("tr." + newfolder + " td").css("background-color", "#F9F8B6");