Orangescrum Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Orangescrum version 1.8.0. This vulnerability allows authenticated attackers to inject malicious scripts that are executed in the browsers of users. The issue arises from improper handling of input parameters, which can be exploited by sending crafted payloads through various application endpoints.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to the 'orangescrum/easycases/edit_reply' endpoint, including a script payload in the 'projid' parameter. This will trigger a reflected XSS vulnerability. Alternatively, for a stored XSS vulnerability, the 'CS_message' parameter can be used to inject a script that will be executed when the message is viewed.