| Título | Feng Office Feng Office Community Edition 3.11.13.11 Cross Site Scripting |
|---|
| Descripción | Stored Cross-Site Scripting (XSS) in Feng Office Community Edition x.x.x.x via unescaped task name output in add_task.php.
Auth required: user with task-creation permission.
Vulnerable sink: application/views/task/add_task.php (~line 361)
echo $parentTask->getTitle(); // no clean()/encoding
Same file safely encodes other titles with clean() (~line 398), confirming incomplete output encoding.
A low-privileged user can store HTML/JS in a task name (og_objects.name). When a privileged user opens the subtask/add-task view that renders the parent title, the payload executes in that user's browser context.
Note: main AJAX task grid uses Handlebars {{escape task_name}} (mitigated), but this server-rendered PHP sink remains. Related public PoC without CVE for x.x.x.x exists on Packet Storm; confirmed still relevant on x.x.x.x for this sink.
CWE-79. Estimated CVSS 3.1 ~5.4–6.1 (PR:L, stored).
Vendor coordination (responsible disclosure):
- 2026-06-14: Included in coordinated disclosure to [email protected] and [email protected] (Nir Yehoshua / Cipher Security Labs), with private write-up and video PoC.
- 2026-06-18: Juan Manjarres acknowledged receipt.
- 2026-07-04 / 2026-07-07: Follow-ups requesting triage/patch/CVE status; no further substantive response.
- 90-day coordinated disclosure date: 2026-09-12.
- External CVE request because Feng Office has not confirmed they will assign CVEs.
Video PoC: https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1ihZjSWrpS-zhqbna/view?usp=sharing
Related prior public writeup (no CVE): https://packetstormsecurity.com/files/177958/fengoffice310821-xss.txt |
|---|
| Fuente | ⚠️ https://drive.google.com/file/d/1Kel7JTTXVcLDPCVpR0LLbIYetANXvkX6/view?usp=sharing |
|---|
| Usuario | ciphersecuritylabs (UID 99852) |
|---|
| Sumisión | 2026-07-16 11:43 (hace 2 meses) |
|---|
| Moderación | 2026-09-12 10:16 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 403085 [Fengoffice Feng Office hasta 3.11.13.11 Task Title Output add_task.php getTitle og_objects.name secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|