Stored-XSS in campaign name displayed in Banners modal

How it was found

Description:

A low-privilege authenticated user can create or edit advertiser/campaign names containing HTML/JavaScript. Those values are stored in the application and later rendered without proper HTML escaping in the admin Inventory → Banners advertiser/campaign picker. When an administrator opens the picker, the stored script executes in the admin’s browser, enabling account takeover, unauthorized admin actions, or sensitive data exposure.

Because any authenticated normal user can store the payload, the attack vector is remote and trivial for an attacker with a valid account.

Steps:

1. I injected a script code XSS:

{F4968699}

2. Result:

{F4968700}

Impact

Remote authenticated attacker (normal user) places JavaScript that executes in administrator browsers. Possible consequences (depending on environment and cookie settings):

• Admin session theft (if cookies are accessible).
• Silent administrative actions performed via the admin session (create/modify/delete resources).
• Disclosure of sensitive UI data accessible to admins.
• Pivot to further compromise of infrastructure or data exfiltration. Because the attacker only needs a normal account to persist payloads, this is highly exploitable and should be prioritized.