Description

Stored cross site scripting vulnerability on Item name parameter in Assest module. Add payload in item name and whenever the user add the item in his requested assest . The alert will trigger.

Proof of Concept

1. Login to the demo account

2. Go to Asset functionality , add or edit an item name with following payload and save

3. payload = "><img src>

4. Go to requested assets , check the item name (payload ), that you added or edit an asset which are already in requested asset

5. If it is there, alert will be triggered