ProjectSend Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in ProjectSend version r1605. This issue allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. The injected script executes when other users view the affected page, creating a persistent script injection risk.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, log in as an administrator and navigate to the custom assets page. From there, access the option to add new JavaScript. Inject a script payload, such as an alert, and save the changes. The injected script will execute when the page is loaded by other users.