Skip to content

Cross Site Script Vulnerability on "Edit Menu" in Mara 7.5 #2

Open
@r0ck3t1973

Description

@r0ck3t1973

/Describe the bug/
An authenticated malicious user can take advantage of a Stored XSS vulnerability in the "Edit Menu" feature.

To Reproduce
/Steps to reproduce the behavior/:

1, Login into the panel
2. Go to '/Mara/codebase/menuedit.php'
3. Insert Payload:
"><script>alert(document.domain)</script>Hello world!
4. Click Test: Alert XSS Message
5. Save and go to Admin Panel
6. Alert XSS Message

/Expected behavior/
The removal of script tags is not sufficient to prevent an XSS attack. You must HTML Entity encode any output that is reflected back to the page

/Screenshots/

  1. go to '/Mara/codebase/menuedit.php'
    capture
  2. Insert Payload
    insert_payload
  3. Click Test: Alert XSS Message
    xss_mess
  4. Save and go to Admin Panel
  5. Alert XSS Message
    xss_mess1

/Desktop (please complete the following information):/
OS: Windows
Browser: All

I Hope you fix it ASAP

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions