Summary
The sylius package is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in various components of the Admin panel via Name field.
Product
This vulnerability affects sylius/sylius and sylius/admin-bundle versions prior to 1.12.16 and 1.13.1.
Impact
The vulnerability allows to inject JavaScript code that will be executed by other administrators, which could lead to serious implications like Account Takeover.
Steps to reproduce
- On the Admin panel, create a new element. A
Taxonfor instance. - Insert a script in the
Namefield in any of the languages:
<script>alert('XSS')</script>- Visit any page where the field
Nameis being rendered.
Expected result:
A pop-up appears on the screen with the message XSS.
Remediation
A fix was merged to sanitize the input to prevent malicious code from being executed.
Credit
This issue was discovered and reported by Checkmarx AppSec Analyst Mário Teixeira.
