DBSyncer Stored Cross-Site Scripting Vulnerability in Edit Profile Feature

A stored cross-site scripting vulnerability has been identified in DBSyncer version 2.0.6, specifically within the Edit Profile feature. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Nickname parameter.

Impact

Exploitation of this vulnerability allows for the execution of injected JavaScript payloads in the context of the affected user, potentially leading to session hijacking, phishing attacks, or other client-side exploitation.

Reproduction

To reproduce this vulnerability, log into the DBSyncer web application as a valid user. Navigate to the 'Edit Profile' section and locate the 'Nickname' field. Inject a script payload, such as a simple alert script, and save the changes. The injected script will be executed when the page is refreshed or when the nickname is displayed elsewhere on the site.