Closed
Description
Description -
There's no escape being done before printing out the value of Title in the Attachment page.
Croogo version - v3.0.5
Steps to reproduce -
-
Navigate to http://localhost/croogo/admin/file-manager/attachments/edit/4 & add the below-shared payload as the value to the Title field.
Payload - webappumldeploy
<img src=xss onerror=alert(1)> -
Visit page http://localhost/croogo/admin/file-manager/attachments, the payload will be triggered.
Metadata
Metadata
Assignees
Labels
No labels

