[SECURITY] - Stored Cross-site Scripting vulnerability before deleting a Scan Engine!

[TheBinitGhimire]

Issue Summary

In reNgine v1.0, there is Stored Cross-site Scripting before deleting a Scan Engine!

Steps to Reproduce

1. Visit your reNgine instance, and login to your account.
2. Head over to the /scanEngine/ endpoint.
3. Click on "Add New Engine" and write ');alert('XSSed by Binit at '+document.location+'!');// in the Engine name field.
4. Now, click on the "Add Engine" button to save the changes.
5. Click on the Delete icon (cross icon) next to the engine name, and the payload will be executed.

Here, the payload will be executed through the values inside the onclick attribute, as shown in the image below:

• I have confirmed that this issue can be reproduced as described on a latest version/pull of reNgine: yes

Technical details

• Debian 4.19.181-1