Jetimob Plataforma Imobiliaria Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Jetimob Plataforma Imobiliaria version 20240627-0. The issue arises in the 'Oportunidades' section when creating or editing an 'Atividade'. The 'Descrição' field permits the injection of JavaScript, which is executed when the activity is loaded.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'Oportunidades' section and create or edit an 'Atividade'. In the 'Descrição' field, inject JavaScript, such as an image tag with an 'onerror' event. Once the activity is saved and loaded, the injected script will execute.