| عنوان | sunkaifei FlyCms master Improper Neutralization of Alternate XSS Syntax |
|---|
| الوصف | Stored XSS: Lack of input sanitization during content submission and failure to escape output on the detail page.
In short: Any registered user can inject a `<script>` tag into the body of a post. Once the post is published, the script executes in the browser of any visitor who views the detail page.
The vulnerability stems from two combined oversights:
| Stage | Code Location | Issue |
| :--- | :--- | :--- |
| Data Ingestion | `ModelDataService#insertData:474` | Only external images are downloaded locally; no HTML sanitization (e.g., via Jsoup) is performed. |
| Data Output | `articles/detail.html:28` (and 19 other locations) `${(info.content)!''}` | The `?html` escape directive is missing, and the template engine does not escape content by default. |
Key prerequisites:
• Registration is open, and the submission endpoint only verifies the user's login status.
• The `content` field is included in the allowed-field whitelist.
• The `fly_model` table lacks an `enable_submit` column, meaning this validation check always passes.
• The configuration `fly_article_audit = '0'` results in `status = "1"`, allowing posts to be published immediately without undergoing moderation.
Verification: Testing with the actual FreeMarker 2.3.32 engine and the production template files confirms that the payload is rendered exactly as provided. In contrast, using `.ftlh` files or explicitly adding `?html` correctly escapes the content. The root cause of this discrepancy is that the `outputFormat` is set to `undefined`; the `<#ftl output_format="HTML">` directive defined in `spring.ftl` is not being propagated to the page templates.
Impact: Attackers can hijack visitor sessions, perform administrative actions, or conduct phishing attacks. There is no `script-src` policy defined in the Content Security Policy (CSP), leaving no fallback protection. |
|---|
| المصدر | ⚠️ https://github.com/sunkaifei/FlyCms/issues/18 |
|---|
| المستخدم | s1mple_xy (UID 82894) |
|---|
| ارسال | 18/10/2026 05:32 PM (22 أيام منذ) |
|---|
| الاعتدال | 09/11/2026 06:11 PM (22 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 433192 [sunkaifei FlyCMS حتى e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a Content Rendering articles/detail.html ModelDataService.insertData content البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|