Please log in to bookmark issues
#2885 –
Investigating
Description
Users with the privilege to create a new issue can store malicious code in the database or any other persistent media, by entering JavaScript code in the “Description” and “Environment” fields located at the “New Bug”, “Improvement Request”, “Task” and “Feature Request” forms. The inserted code will be executed every time the data is retrieved by another user.
How to reproduce
Steps to Reproduce Exploit:
- Click on the “New Issue” option.
- Click on any option, in this case, click on the “Bug” option.
- In the “DESCRIPTION” field, type the following script: Bug"><img src=a onerror=alert(1)>Testing.
- In the “ENVIRONMENT” field, type the following script: <img src=”x” onerror=alert(“PXSS2”)>.
- Fill out the other fields with any value and click on the “File issue” button.
- Once the issue is created, go to the section where all the issues are displayed; as you can see, the script is executed.
- Then look for the created issue and open it.
- Finally, the other injected script is executed, proving that XSS can be stored in the application’s database.
Attachments0
Important details
Times and dates
-
Estimated time No time estimated
People involved
-
thnguyen
-
-
zegenie
- Subscribers 1 Click here to show the list of subscribers
Other details
-
-
-
Not determined
Post a comment and get things done