# Affected software: Akeneo Online Demo
# Type of vulnerability: stored xss
# URL: http://www.akeneo.com/demo/
# Discovered by: Provensec
# Website: http://www.provensec.com
# Description:Akeneo is an open source Product Information Management
(PIM) system designed for retailers looking for efficient answers to
their multichannel needs.
# Proof of concept

username field of profile section was vulnerable to stored xss

http://demo.akeneo.com/#url=/user/profile/edit

edit the Username with payload "><img src=d onerror=confirm(1);> and
java script will execute

#screen http://prntscr.com/69ywwr