BUG

stored xss using journal-role when user try to export user of any journal

SUMMURY

lower level user can attack higher level user using this xss

STEP TO REPRODUCE

1. from Admin account create a journal called “journal-A” .

2. Admin goto above journal http://localhost/ojs/index.php/dddd/management/settings/access#users and add a new user called “user-B” with role “Production editor” .

3. Now from user-B goto “user & role” of above journal-A http://localhost/ojs/index.php/dddd/management/settings/access#roles and create a new role with xss payload xss"''&gt;<img src> in “Role Name” field .

4. Now goto admin account and goto above journal-A then Statistics->Users . here url look like http://localhost/ojs/index.php/dddd/stats/users/users.\
Here admin try to export the users and xss is executed