Summary

A Cross-Site Scripting (XSS) vulnerability exists in the TicketsController and Moderation/TicketsController due to insufficient input validation on the priority field during ticket creation and unsafe rendering of this field in the moderator panel.

Details

The TicketsController does not validate or sanitize the priority field during ticket creation:

public function store(Request $request, GeneralSettings $generalSettings)
    {
       ...
       $validateData =  [
            'title' => 'required',
            'ticketcategory' => 'required',
            'priority' => 'required',
            'message' => 'required',
        ];
        ...
    }

In Moderation/TicketsController, this unsanitized data is rendered with raw HTML in the dataTable method:

...
->editColumn('priority', function (Ticket $tickets) {
    return __($tickets->priority);
});
->rawColumns(['category', 'title', 'user_id', 'status', 'priority', 'updated_at', 'actions'])
...

Impact

Attackers can execute malicious scripts in the moderator’s browser

PoC

Patches

393cbde