CVE-2023-48198
Product detail ⌗
A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cookies.
Prerequisite ⌗
Install Grocy from official Grocy Github repository
GitHub page
![](https://nitipoom-jar.github.io/CVE-2023-48198/1.png)
Grocy version 4.0.3 released on Sep 2
![](https://nitipoom-jar.github.io/CVE-2023-48198/1.gif)
Installation on Portainer Docker
![](https://nitipoom-jar.github.io/CVE-2023-48198/2.gif)
![](https://nitipoom-jar.github.io/CVE-2023-48198/2.png)
Installed Grocy version 4.0.3
Exploitation ⌗
1. Go to Manage master data
2. Select products
3. Add new product
4. Insert malicious script in the description
As you can see in the gif below:
![](https://nitipoom-jar.github.io/CVE-2023-48198/3.gif)
When the victim visit this page and click on the malicious product description, the cookie can get stolen.
![](https://nitipoom-jar.github.io/CVE-2023-48198/4.png)