Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86398155

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Authenticated Stored Cross-Site Scripting (XSS) Via Search
Document
# Google Dork: N/A
# Date: 1/28/2025
# Exploit Author: maeitsec
# Vendor Homepage: https://pimcore.com/
# Software Link: https://github.com/pimcore/pimcore
# Version: Pimcore 10.5.x (prior to 10.5.21) and 11.x (prior to 11.1.1)
# Tested on: Pimcore 10.5.20 on Ubuntu 20.04
# CVE:  CVE-2024-11954

---

### Description:
A stored Cross-Site Scripting (XSS) vulnerability exists in Pimcore's Data
Object Classification Store functionality. The vulnerability arises due to
insufficient input sanitization, allowing an authenticated attacker with
access to the classification store to inject malicious JavaScript code.
This code is then executed in the context of other users' browsers when
they view the affected data.

### Proof of Concept (PoC):
1. Log in to the Pimcore backend as a user with access to the Data Object
Classification Store.
2. Navigate to the Classification Store and create or edit a key.
3. Inject the following payload into the key value:
   ```html
   <script>alert('XSS')</script>
4. Save the file and view it in the frontend or backend. The JavaScript
alert will execute, demonstrating the vulnerability.