Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
An authenticated malicious user can take advantage of a Stored XSS vulnerability in the "Global Variables" feature.
<img src=1 onerror='alert(document.coookie)'/>
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
The text was updated successfully, but these errors were encountered:
CVE-2022-43165
Sorry, something went wrong.
No branches or pull requests
Version: 3.2.1
Description
An authenticated malicious user can take advantage of a Stored XSS vulnerability in the "Global Variables" feature.
Proof of Concept
Step 1: Go to "/index.php?module=global_vars/vars", click "Create" and insert payload "
<img src=1 onerror='alert(document.coookie)'/>" in Value field.Step 2: Alert XSS Message
Impact
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user.
The text was updated successfully, but these errors were encountered: