We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Summary hi team, I found a small Stored XSS
Info
Zenario 9.4
Step 1: Login to account https://demo.zenar.io/admin
Step 2: In the tab menu click on event and create a new event
Step 3: Inject payload to Menu navigation text, choice menu note menu (simple choice account ), and save the event
Step 4: Go to Menu navigation and click on account. And move the mouse to the event then the payload is executed
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Summary
hi team,
I found a small Stored XSS
Info
Zenario 9.4
Step 1:
![image](https://private-user-images.githubusercontent.com/132877337/256102652-3e4a1af5-ddd6-46db-825b-0f3a67cd6c35.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU0Nzc2NzEsIm5iZiI6MTcyNTQ3NzM3MSwicGF0aCI6Ii8xMzI4NzczMzcvMjU2MTAyNjUyLTNlNGExYWY1LWRkZDYtNDZkYi04MjViLTBmM2E2N2NkNmMzNS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTA0JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkwNFQxOTE2MTFaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0zYmQxZmRiMGExMWRkNGRlZmQ3NTQ2NGIxOGUwM2JkZWU5ZGVhNTE4NjNiYjJlMTZlZTAwNjQyNjZiMjY2MDQ0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.g156mcvkefzoUfZQcs6wEKKiyb4zTSO9oee9vdp5B78)
Login to account https://demo.zenar.io/admin
Step 2:
![image](https://private-user-images.githubusercontent.com/132877337/256103272-11a07a44-259f-4645-ae74-db82cf283ca8.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU0Nzc2NzEsIm5iZiI6MTcyNTQ3NzM3MSwicGF0aCI6Ii8xMzI4NzczMzcvMjU2MTAzMjcyLTExYTA3YTQ0LTI1OWYtNDY0NS1hZTc0LWRiODJjZjI4M2NhOC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTA0JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkwNFQxOTE2MTFaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1lM2FmZTRlNDc5ZjlmNzY0N2QzMjk1NmQxNmU0ZDYwZWY0M2Y5MWEwOTUxYzg2ZDk1MWU4MjE5ZWY4Y2RlZjVjJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.mpioSVeYRvfX6B0vSOytjq-r5lNy4TzMTOigQmbvECY)
In the tab menu click on event and create a new event
Step 3:
![image](https://private-user-images.githubusercontent.com/132877337/256104738-2b899c51-c71e-4a14-8907-408abdfb5302.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU0Nzc2NzEsIm5iZiI6MTcyNTQ3NzM3MSwicGF0aCI6Ii8xMzI4NzczMzcvMjU2MTA0NzM4LTJiODk5YzUxLWM3MWUtNGExNC04OTA3LTQwOGFiZGZiNTMwMi5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTA0JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkwNFQxOTE2MTFaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0wM2YzMjgzZDhiOTgxMmFjMGMwMmY2ZjI0MWNiMjhjOTg5MjRjMjQwYjU4N2E2NDA5MmEyMmI2Y2QzZjcyNGM0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.B2T9beluZ5je6d8OJ_zsycW35ZvAtR-28XHgu26Rk3s)
Inject payload to Menu navigation text, choice menu note menu (simple choice account ), and save the event
Step 4:
![image](https://private-user-images.githubusercontent.com/132877337/256106808-e4836e3a-cb94-433a-b0f6-29bbe159421a.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU0Nzc2NzEsIm5iZiI6MTcyNTQ3NzM3MSwicGF0aCI6Ii8xMzI4NzczMzcvMjU2MTA2ODA4LWU0ODM2ZTNhLWNiOTQtNDMzYS1iMGY2LTI5YmJlMTU5NDIxYS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwOTA0JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDkwNFQxOTE2MTFaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1kZTNjN2I0ZTY1ZWQ4NzhiZTMxM2RiMDZmYjE5NThlNGQ0MWJmMzgyNmVmNjFkZjE0MmYzMWYxNTEyYzIxODg1JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.pzUOf0A_1G2zU9ZIhvu7-C7Dbh5bH_PvhK0dJ6c7sTA)
Go to Menu navigation and click on account. And move the mouse to the event then the payload is executed
The text was updated successfully, but these errors were encountered: