Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the /projets endpoint of SOPlanning. A malicious attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be stored and executed when someone opens the edited page, potentially compromising the security of users viewing that page.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to execute malicious scripts in the context of the affected website for users who visit the compromised page. This can lead to theft of user data, session hijacking, defacement, or other malicious actions depending on the injected code. Since the attacker needs only medium privileges, it increases the risk of exploitation by insiders or users with limited access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SOPlanning to version 1.55 or later, as this version contains the fix for the Stored XSS vulnerability in the /projets endpoint.

Useful 0 Not Useful 0