Self Stored XSS using crafted category name
- Weboob's version I am using is: 1.3
- Kresus's version I am using is: 0.10.2
- Is Kresus running within CozyCloud or without? without
- Steps to reproduce:
- name a category as
<img src=x onerror=alert(0)>
- in the graphic page, at hover on any category bar, the payload is executed
- name a category as
- What I expect: category names displayed in the graphic legend should be escaped
- What I observe: when the graphic legend is displayed the malicious category name isn't sanitized properly
As far as I know, this is "only" a self-XSS. But this issue should be corrected because it may be possible to leverage it using these techniques, or simply by using social engineering to convince users to import a malicious JSON export (and then to add their real bank accounts).