MonicaHQ Client-Side Injection Vulnerability Leading to Stored Cross-Site Scripting

A client-side injection vulnerability has been identified in MonicaHQ version 4.1.2. This authenticated vulnerability allows attackers to inject malicious code into the 'reason' parameter of the 'Add Debt' form, located at '/people/h:[id]/debts/create'. The injected code can lead to stored cross-site scripting (XSS) attacks.

Impact

Exploitation of this vulnerability allows for authenticated client-side injection, which can be exploited to execute stored cross-site scripting (XSS) attacks.

Reproduction

To reproduce this vulnerability, an authenticated user must navigate to the 'Add Debt' form within the '/people/h:[id]/debts/create' section. Once there, inject a payload into the 'reason' field. The payload can be a JavaScript injection, such as one that triggers an alert.