Rukovoditel Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Rukovoditel version 3.4.1. This vulnerability allows authenticated attackers to inject malicious scripts that are executed in the context of the user's browser. The issue arises from the application's handling of copyright text, where attackers can insert iframe and script payloads to execute arbitrary JavaScript.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into an account and create a project. Add a task and open it, then insert a comment containing an iframe payload. Alternatively, an admin can inject a script payload into the copyright text via the application configuration.