CVE-2023-40869

Cross Site Scripting vulnerability in mooSocial mooSocial Software v.3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a crafted script to the edit_menu, copuon, and group_categorias functions

XSS STORE via CSRF.

#Paths Affected http://admin-socialcommerce.moosocial.com/admin/group/group_categories http://admin-socialcommerce.moosocial.com/admin/coupon/ http://admin-socialcommerce.moosocial.com/admin/menu/manage/edit_menu/6

Poc:

1 - Make a file with this HTML and with and include XSS PAYLOAD

##payload in this example and encoded : test">test

2 - Example test.html

3 - Send to the victim

4 - When the victim open the html the file test.html will open in his navigator and when he will open and press click the code will inject a payload and will be store at the DataBase