huntr.dev Open in urlscan Pro
2600:9000:223d:aa00:14:bb32:5f00:93a1  Public Scan

Form analysis
0 forms found in the DOM

Text Content

huntr
Open menu
/
Bounties 524 Community More

Responsible disclosure policy

FAQ

Contact us

Hacktivity

Leaderboard

Submit report Login

Logout

huntr
Close menu
/

--------------------------------------------------------------------------------

Bounties
Find your next target
Submission
Submit a report
Hacktivity
Browse public reports
Leaderboard
Our leaderboard

--------------------------------------------------------------------------------

Policy FAQ Contact us
Login


XSS IN BUTTON HOME PAGE IN PIMCORE/PIMCORE

0

Valid

Reported on

Feb 23rd 2023

--------------------------------------------------------------------------------


DESCRIPTION

vuln was find in File/Documents/Home , any button in page


PROOF OF CONCEPT

1. Login in  URL : https://demo.pimcore.fun/admin
2. Go to File -> Open Documents -> Home
3. click any button in page -> Edit Link  
4. in tab Advanced, inject payload to : ```Attributes (key="value")```

For more understanding please check POC.
// PoC.js
var payload = \'><details/open/ontoggle=confirm(document.domain)>
POC : https://drive.google.com/file/d/110JMIEA_ngdVB-k5cM9wnX8p7KtW7npD/view?usp=share_link



IMPACT

An attacker can use XSS to send a malicious script to any user.

We are processing your report and will contact the pimcore team within 24 hours.
13 days ago
We have contacted a member of the pimcore team and are waiting to hear back 12
days ago
A pimcore/pimcore maintainer has acknowledged this report 9 days ago
Divesh Pahuja validated this vulnerability 7 days ago
HMs has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Divesh Pahuja marked this as fixed in 10.5.18 with commit c6368b 7 days ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
Divesh Pahuja published this vulnerability 7 days ago
Sign in to join this conversation
CVE

CVE-2023-1115 (published)
Vulnerability Type
CWE-79: Cross-site Scripting (XSS) - Stored
Severity
High (7.6)
Attack vector Network
Attack complexity Low
Privileged required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity Low
Availability Low
Open in visual CVSS calculator
Registry
Nuget
Affected Version


10.5.17

Visibility
Public
Status
Fixed

Found by

HMs
@hieuminhnv
unranked

This report was seen 296 times.
We are processing your report and will contact the pimcore team within 24 hours.
13 days ago
We have contacted a member of the pimcore team and are waiting to hear back 12
days ago
A pimcore/pimcore maintainer has acknowledged this report 9 days ago
Divesh Pahuja validated this vulnerability 7 days ago
HMs has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Divesh Pahuja marked this as fixed in 10.5.18 with commit c6368b 7 days ago
The fix bounty has been dropped
This vulnerability has been assigned a CVE
Divesh Pahuja published this vulnerability 7 days ago
Sign in to join this conversation

2022 © 418sec




HUNTR

 * home
 * hacktivity
 * leaderboard
 * FAQ
 * contact us
 * terms
 * privacy policy


PART OF 418SEC

 * company
 * about
 * team



Chat with us