Stored XSS in dev-ucrm-billing-demo.ubnt.com In Client Custom Attribute

How it was found

Hey,

Was Testing the subdomins when I came Accross the subdomain https://dev-ucrm-billing-demo.ubnt.com/ I logged in as an Administrator and while testing i added a User and In Client Custom Attribute 1 i added the Payload: "><IMG src=x onerror=prompt(1);>"">><marquee><img src=x onerror=confirm(3)></marquee>"/ and Save the Client and Then on client page i.e: https://dev-ucrm-billing-demo.ubnt.com/client/24 When User click on Show more (under Custom Attribute 1) The XSS payload executes :)

{F227283}

{F227284}

If another Admin or A user will perform the steps to see the custo atributes his/her account can be takenover By Such Pentest XSS By using tools like https://xsshunter.com/app etc :)