# Reflected XSS - Current Goals

## Reflected XSS (authenticated)  <a href="#finding1" id="finding1"></a>

Performance Pro v3.19.17 and earlier is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities (Persistent/Type II) via POST requests to:

{% hint style="warning" %}
`/index.php?mode=mGoalSetup&job=update&id=<goal_id>`
{% endhint %}

### Description

The application is vulnerable to multiple instances of stored (persistent) XSS in the Current Goals functionality. Malicious input provided by an authenticated user is stored server-side and later rendered into the DOM without proper encoding or sanitization. This allows execution of arbitrary JavaScript in the context of any user viewing the affected pages.

## **Affected Endpoints and Parameters:**

**Input (create/update goal):**\
Vulnerable fields:

* Goal Name
* Goal Notes (name field)
* Action Step Name
* Notes Name

**Reflected when viewing/printing goals:**\
`GET /viewgoals.php?printview=1&type=current`\
Vulnerable fields:

* Goal Name
* Goal Description
* Action Step Description

{% hint style="danger" %}
This vulnerability allows attackers to execute malicious scripts, alter the user's interface, and potentially redirect users to malicious sites.
{% endhint %}

***

### Exploitation

* Inject malicious javascript into any of the following input fields for current goals.&#x20;
  * Goal Name
  * Goal Description
  * Action Steps Name
  * Action Steps Description
  * Note Name
* **Send** the crafted URL to a victim via phishing, social engineering, or any other attack vector.
* When the victim navigates to the modified URL, the application reflects the malicious input directly into the browser without sufficient sanitization.
* **The victim’s browser renders the injected payload** in the error message, allowing arbitrary script execution within the victim's browser.

### Example 1 - XSS in Updating/Creating Current Goals

* Any of the highlighted fields are vulnerable to XSS between the Update/Creation\
  ![](https://2946459361-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGyD3p56S2Ma0Q756LEYJ%2Fuploads%2FFs0DTQqIuyiI72C4oHDm%2Fimage.png?alt=media\&token=3a98ded6-5b1e-4c95-a4d8-0ce8243dfde5)<br>
* Action Steps injection\
  ![](https://2946459361-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGyD3p56S2Ma0Q756LEYJ%2Fuploads%2F0VNMLNV9so0GPwL7lJ39%2Fimage.png?alt=media\&token=ec93c936-c666-4609-b868-dadc7780ecc8)
* Notes injection\
  ![](https://2946459361-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGyD3p56S2Ma0Q756LEYJ%2Fuploads%2FToDMGb7Lz15hsbaa7WS2%2Fimage.png?alt=media\&token=c0899484-3a3b-4451-b510-53070e70c688)
* Successful XSS exploitation\
  ![](https://2946459361-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGyD3p56S2Ma0Q756LEYJ%2Fuploads%2FWTZs7vuzMRL5Mt2jSo3J%2Fimage.png?alt=media\&token=ce684042-ed07-4e12-9004-e3b54f35dd83)

Example 2 - XSS in View/Print of Current Goals

* Any of the highlighted fields are vulnerable to XSS in the View/Print URL\
  ![](https://2946459361-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGyD3p56S2Ma0Q756LEYJ%2Fuploads%2FrFJU3LacSknX7k5pPR4c%2Fimage.png?alt=media\&token=ceb6f4de-e8aa-40c6-8d29-5c864bc26f8f)
* Successful XSS exploitation\
  ![](https://2946459361-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGyD3p56S2Ma0Q756LEYJ%2Fuploads%2F7qvfQUpBblodQxESea5Z%2Fimage.png?alt=media\&token=af3d13c9-ce48-43c1-8376-35193daaa668)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability/reflected-xss-current-goals.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.