ASUSTOR ADM Stored Cross-Site Scripting Vulnerability in Access Control

A stored Cross-Site Scripting vulnerability has been identified in the Access Control of ASUSTOR's ADM. This vulnerability allows attackers to inject malicious scripts into the folder name field when creating a new shared folder. The injected scripts are not properly sanitized and are executed when the folder name is displayed in the user interface. This could enable attackers to execute arbitrary JavaScript in the context of another user's session, potentially accessing session cookies or other sensitive information. The vulnerability affects ASUSTOR ADM versions 4.1.0 through 4.3.3.RH61, as well as ADM 5.0.0.RIN1 and earlier.

Impact

Exploitation of this vulnerability allows for stored Cross-Site Scripting, where injected scripts are executed in the context of the user viewing the folder name, potentially leading to the theft of session cookies or other sensitive data.