Stored XSS in Email Notifcation

How it was found

Summary:

Hi team user input most be Decoded this is wired Stored XSS as the XSS been fired in https://crm.na1.insightly.com/list/Email/ when ever user open the ==Notifcation == message been send or even refresh his mail service as the site https://crm.na1.insightly.com/list/Email/ ==Notifcation== execute the ==Subject Emaill name Code== as Code and when ever any user in the Group login and try to see the ==Notifcation== XSS fired

Steps To Reproduce:

1-Create Two account and invite user to join to your Group 2-add email service to enable send email in the platform 3-as ==any user in the Group= able to see sended message ==Create email== and enter this payload as Subject name

<img src="X" onerror=top[8680439..toString(30)](1337+document.cookie)>

4-as The Emaill ==Subject name been executed== when ever user login and try to see the missing ==Notifcation== The XSS been Fired

Video POC: ███████

Impact

as any user in the Group able to see the ==Notifcation== attacker able to still users Cookie