[SECURITY] - Stored Cross-site Scripting vulnerability through Organization Name at All Targets page!

[TheBinitGhimire]

Found a bug? Please fill out the sections below. 👍

Issue Summary

In reNgine v1.0, there is Stored Cross-site Scripting vulnerability through Organization Name at All Targets page!

Steps to Reproduce

1. Visit your reNgine instance, and login to your account.
2. Add some targets through the Targets page.
3. Head over to the /target/list/organization endpoint.
4. Click on "Add Organization" and write <img src=binit onerror="alert('XSSed by Binit at '+document.location+'!')"> in the Organization name field.
5. Select targets, and add the organization.
6. Visit the Targets page at /target/list/target, and you will see that the XSS payload gets executed.

• I have confirmed that this issue can be reproduced as described on a latest version/pull of reNgine: yes

Technical details

• Debian 4.19.181-1