## https://sploitus.com/exploit?id=3588CEC2-8273-57A7-A952-12012FC795EF
<b> #CVE-2024-41453 </b>
<b> #CVE-2024-41454 </b>
ProcessMaker Vulnerabilites (just for education):
@ryancooley @velkymx @nolanpro @caleeli
- install ProcessMaker 4 Core Docker Instance frome this repository:
https://github.com/ProcessMaker/pm4core-docker
- this is latest pm docker version (PM_VERSION=4.1.21), below image is the .env file.

# Stored Xss
1. create a json file with xss payload.

(I uploaded sample file named: sample.json)
2.Send this file to process admin user and request to import thie file as a process.



3. when admin user import this file and try to archive this process, the malicious javascript code will be executed.
(chrome latest version: Version 126.0.6478.127 (Official Build) (64-bit))

It is obvius that in import function there is lack of user input sanitization.
# Maliciuos file upload
1. admin user can upload html file and bypass image restrication in Customize UI, custom login logo upload section.

2. this is uploaded file:

3. also it is possible to uplaod php file but its not executed.


there is lack of proper input validation in uploaders.