Feehi CMS 2.1.1 - Stored Cross-Site Scripting (Stored XSS) in Permission

[thinhneee]

Severity Score: Medium
CVSS score: 6.9
Vecto string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Description:

Feehi CMS 2.1.1 allows authenticated users with RBAC/Permission creation privileges to inject malicious scripts via the Group, Category, and Description fields due to a lack of input sanitization. While these fields are the entry points, the vulnerability manifests as a Stored XSS at critical endpoints such as the "Create Admin User" page.

Impact:

If the superadmin create new admin user, the malicious JS file may execute, it can lead to steal admin's cookie.

POC:

Step 1: Create a new permissions and inject the XSS payload in Group, Category or Description Fields.

Step 2: Create new admin user and see the payload is executed.