<h3 id="heading-vendor-homepage"><strong>Vendor Homepage:</strong></h3>
<p><a target="_blank" href="https://opencollective.com/badaso">Badaso - Open Collective</a></p>
<h3 id="heading-version"><strong>Version:</strong></h3>
<p>2.9.7</p>
<h3 id="heading-tested-on"><strong>Tested On:</strong></h3>
<p>Marcos, review source code</p>
<h3 id="heading-affected-page"><strong>Affected Page:</strong></h3>
<p><a target="_blank" href="https://badaso-demo.uatech.co.id/dashboard/general/books/add">https://badaso-demo.uatech.co.id/dashboard/general/books/add</a></p>
<p><a target="_blank" href="https://badaso-demo.uatech.co.id/dashboard/general/books/1/edit">https://badaso-demo.uatech.co.id/dashboard/general/books/1/edit</a></p>
<h3 id="heading-description"><strong>Description:</strong></h3>
<p>A vulnerability XSS injection was found in Badaso v2.9.7. Cross-site scripting (XSS) is a type of security vulnerability that occurs when a web application includes untrusted data in its output to a web browser. This can allow malicious scripts to be executed by a user's browser, potentially compromising their data and interactions with the website. XSS attacks can have various impacts, including stealing sensitive information, session hijacking, defacement of websites, and more</p>
<h3 id="heading-proof-of-concept"><strong>Proof of Concept:</strong></h3>
<ol>
<li><h4 id="heading-login-and-access-to-function-add-racks">Login and Access to function add racks.</h4>
<p> <img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1693210649914/8c1ff0e5-9047-494f-9ef5-4872849810d7.png" alt class="image--center mx-auto" /></p>
</li>
<li><h4 id="heading-inject-payload-xss-alert-1-to-rank-book-groups">Inject payload XSS alert 1 to rank Book Groups.</h4>
<pre><code class="lang-plaintext"> "' test &lt;img src="" onerror="alert(1)"&gt;
</code></pre>
<p> <img src="https://user-images.githubusercontent.com/132877337/252541725-9a3423b8-8c8d-4e3d-8c1a-9143390ac4d0.png" alt="image" /></p>
</li>
<li><p><img src="https://user-images.githubusercontent.com/132877337/252542196-01839383-0b82-4cdc-b1e5-f65ac47267a2.png" alt="image" /></p>
<p> Go to books and add a new book or go to edit books then malicious is executed.</p>
<p> <img src="https://user-images.githubusercontent.com/132877337/252542254-8cf72c66-d713-4d09-b294-d9a632b9cf32.png" alt="image" /></p>
</li>
</ol>


### **Vendor Homepage:**

[Badaso - Open Collective](https://opencollective.com/badaso)

### **Version:**

2.9.7

### **Tested On:**

Marcos, review source code

### **Affected Page:**

[https://badaso-demo.uatech.co.id/dashboard/general/books/add](https://badaso-demo.uatech.co.id/dashboard/general/books/add)

[https://badaso-demo.uatech.co.id/dashboard/general/books/1/edit](https://badaso-demo.uatech.co.id/dashboard/general/books/1/edit)

### **Description:**

A vulnerability XSS injection was found in Badaso v2.9.7. Cross-site scripting (XSS) is a type of security vulnerability that occurs when a web application includes untrusted data in its output to a web browser. This can allow malicious scripts to be executed by a user's browser, potentially compromising their data and interactions with the website. XSS attacks can have various impacts, including stealing sensitive information, session hijacking, defacement of websites, and more

### **Proof of Concept:**

1. #### Login and Access to function add racks.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1693210649914/8c1ff0e5-9047-494f-9ef5-4872849810d7.png align="center")
    
2. #### Inject payload XSS alert 1 to rank Book Groups.
    
    ```plaintext
    "' test <img src="" onerror="alert(1)">
    ```
    
    ![image](https://user-images.githubusercontent.com/132877337/252541725-9a3423b8-8c8d-4e3d-8c1a-9143390ac4d0.png align="left")
    
3. ![image](https://user-images.githubusercontent.com/132877337/252542196-01839383-0b82-4cdc-b1e5-f65ac47267a2.png align="left")
    
    Go to books and add a new book or go to edit books then malicious is executed.
    
    ![image](https://user-images.githubusercontent.com/132877337/252542254-8cf72c66-d713-4d09-b294-d9a632b9cf32.png align="left")

Tuan Anh's Blog

Tuan Anh's Blog

Badaso version 2.9.7 has XSS vulnerability in add ranks

Vendor Homepage:

Version:

Tested On:

Affected Page:

Description:

Proof of Concept:

Inject payload XSS alert 1 to rank Book Groups.