Description

It was discovered that it is possible to inject a malicious payload into the email address field, resulting in a stored XSS vulnerability.

Proof of Concept

1. Access to emails parameters /scp/emails.php

2. create an account with the following email address

Payload test+(<script>alert(document.domain)</script>)@gmail.com

it works with all email account because they will be put in the drop-down list

3. Once the account is created, navigate to the settings section of emails

4. XSS is executed