Lucene search

K
huntrQuanghuy25112000C275A2D4-721F-49F7-8787-B146AF2056A0
HistoryAug 05, 2023 - 5:00 p.m.

Cross-site Scripting (Stored XSS)

2023-08-0517:00:01
quanghuy25112000
www.huntr.dev
15
cross-site scripting
stored xss
function assets
html file
proof of concept
bug bounty

EPSS

0.001

Percentile

23.8%

Description

For any role that has permission to execute function assets, i can upload a html file and that leads to XSS.

Proof of Concept

  1. Link PoC: https://docs.google.com/document/d/1pZAi6PZiBmN3yNsBmY8Z9Qd3_hv-8zPHUh69h-i1rvA/edit?usp=sharing
  2. Link video PoC: https://photos.app.goo.gl/XhZa1LTUN9265L667

EPSS

0.001

Percentile

23.8%

Related for C275A2D4-721F-49F7-8787-B146AF2056A0