Stored-XSS in Banner Name field

How it was found

Version:

==revive-adserver 6.0.0==

Summary:

A stored Cross-Site Scripting (XSS) vulnerability exists in the Banner → Name field. An attacker can create or edit a banner with a malicious payload in the Name field; that payload is stored and later executed in the browser of users who were added to the banner via User Access (under Advertisers) when they view the banner. This results in persistent JavaScript execution in the context of the victim’s session.

Note: This Stored-XSS is outside this area as you said: Banners require full Javascript support and so do prepend/append codes. Most of the HTML banners or tracking scripts in fact are just a single <script> tag.

Step to reproduce:

1. Go to Banners → Create (or edit an existing banner).
2. In the ==Name field==, insert the payload: "><script>alert(1)</script>
3. Save the banner. The name is persisted in the database.
4. Add another user (victim) to the banner under User Access (Advertisers)
5. Log in as that added user. Go to Banners --> XSS

Impact

• Persistent XSS executing in the browser of users with access to the banner via User Access (Advertisers)

Video PoC: ███