Description

Stored XSS is a vulnerability in which the attacker can execute arbitrary javascript code in the victim’s browser. The XSS payload is stored in a webpage and it gets executed whenever someone visits that webpage.

Proof of Concept

1 Visit “Contact Us” page and put <img src> in Message field. Click on Send Message button.

2 Now, the admin opens the Contact Us module in admin panel and attacker’s xss payload will be executed.

Impact

The attacker can execute any arbitrary javascript code and acheive the following:

1. Steal CSRF token of the admins and do any unintended actions on their behalf like enable/disable a module, change website etc.
2. Execute malicious javascript e.g. crypto miners

and many more…