Kh0Kamoni

**Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.0 **Description A stored and blind cross-site scripting (XSS) issue exists in the form title field. An attacker can inject JavaScript without authentication via a form title, which is saved in the backend database. When a user visits the affected page, the JavaScript payload is executed. The vulnerability occurs because the application stores malicious user input in its backend database and renders it later on a page viewed by other users without proper sanitization or encoding. The attacker can inject JavaScript payloads in the title field of a form, which the application stores in the database. When any user views the page that displays this title, the malicious script executes in their browser context. A proof of concept involves visiting a specific form URL, injecting a script into the 'Name of the event' and 'Description' fields, and saving the record. The payload is then executed when anyone visits the diary record. **Recommendations Update to YesWiki version 4.6.0 or later.

The issue is related to a reflected cross-site scripting (XSS) attack. A malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input.

A stored and blind cross-site scripting (XSS) issue exists in the Name Field of the user profile. An attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books.

A stored and blind XSS issue exists in the Phone Number field of the user profile within the Group-Office application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction.

A DOM-based Cross-Site Scripting (XSS) issue exists in the Group-Office application, allowing attackers to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability can be triggered by injecting a crafted payload into a parameter that is later processed unsafely in the DOM.

The issue is a persistent Cross-Site Scripting (XSS) vulnerability in Group-Office's tasks comment functionality. This allows attackers to execute arbitrary JavaScript by uploading a file with a crafted filename. When administrators or other users view the task containing this malicious file, the payload executes in their browser context. The application fails to sanitize image filenames before rendering them in the comment. By uploading an image with a crafted filename containing XSS payloads, attackers can steal sensitive information.