Projeto Siga Siga WF Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Projeto Siga Siga WF version 11.0.3.18. This vulnerability affects the 'Cadastro de Responsáveis' module, specifically the 'Nome' and 'Descrição' fields. The application fails to properly sanitize or encode user input before rendering it in the HTML response, allowing injected JavaScript to execute. The vulnerability can be exploited remotely, with the injected payload being stored and executed automatically when the data is accessed through the 'Listar' interface. This issue has been publicly disclosed and reported to the project's maintainers, but no response has been received.

Impact

Exploitation of this vulnerability allows for the execution of injected JavaScript in the context of an authenticated user, potentially leading to the exposure of session cookies and other sensitive information. This could also serve as a stepping stone for more advanced attacks within the application.

Reproduction

To reproduce this vulnerability, navigate to the 'Cadastro de Responsáveis' creation page. Insert a payload, such as an image tag with an 'onerror' event, into the 'Nome' or 'Descrição' fields. Save the entry, then access the 'Listar' page for 'Cadastro de Responsáveis' to see the payload executed.