Stored XSS via User-Agent Injection in Subscribed Emails Admin Page

Vulnerability Overview Title: Stored XSS in the Subscribed Emails Admin Page via the User-Agent Header Description: Summary: An unauthenticated attacker can trigger a stored XSS vulnerability on the admin subscribed emails page by injecting malicious JavaScript into the User-Agent header when creating the request. Details: The frontend subscription process stores attacker-controlled request metadata, including , directly into the subscriber table. When the admin page renders this data, the stored field is not output-encoded, leading to a stored XSS vulnerability. Impact Scope Affected Versions: master Fixed Versions: 231052 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality: Low - Integrity: High - Availability: None Remediation Relevant Code: - The vulnerability in the storage flow is implemented in the function within . - The backend rendering source is located in . POC Code Exploitation Code Verification Results Anonymous subscription requests are accepted. The malicious is persisted in the database. The script is triggered when an admin accesses the subscribed emails page. Impact Affected Parties: - Administrators who open the subscribed emails page. - Deployments exposing the public news subscription form. Security Impact: - Persistent XSS in the backend admin panel. - Theft of admin session data, depending on browser protections. - Execution of arbitrary actions within the admin authentication context. - Phishing, UI redressing, or privilege abuse within the admin session. Since this issue can be triggered by an anonymous user but affects an admin-only page, it represents a significant cross-privilege boundary stored XSS vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS via User-Agent Injection in Subscribed Emails Admin Page

More from this source