Listen to this Post
The Grav admin plugin, an HTML interface for configuring Grav and managing pages, contains a stored cross-site scripting (XSS) vulnerability in versions before 1.11.0-beta.1. The flaw resides in the `/admin/accounts/groups/Grupo` endpoint, specifically within the `data[bash]` parameter. Attackers with administrative access can inject malicious JavaScript payloads into this parameter during group creation or modification operations. Due to insufficient input sanitization, the injected script is persistently stored on the server. When any user, typically an administrator, subsequently accesses the group management page, the malicious code is automatically rendered and executed within their browser context. This execution occurs without requiring further interaction, enabling attackers to steal session cookies, hijack admin sessions, perform unauthorized actions, or deface the admin panel. The vulnerability leverages the trust placed in the admin interface, making it a significant risk for privilege escalation and full compromise of the Grav instance. The issue is addressed in version 1.11.0-beta.1 through proper validation and escaping of user-supplied input in the affected parameter.
Platform: Grav
Version: Before 1.11.0-beta.1
Vulnerability: Stored XSS
Severity: Medium
Date: 12/01/2025
Prediction: Patched in 1.11.0-beta.1
What Undercode Say:
Analytics:
Showing bash commands and codes related to the blog .
curl -X POST -H “Content-Type: application/json” -d ‘{“readableName”: ““}’ http://localhost/admin/accounts/groups/Grupo
Test:
how Exploit:
1. Authenticate as admin.
2. Inject script via readableName.
3. Trigger execution on page load.
Protection from this CVE
Update to 1.11.0-beta.1.
Implement input sanitization.
Use Content Security Policy.
Impact:
Session hijacking possible.
Admin privilege escalation.
Data theft risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
