| عنوان | linlinjava litemall ≤v1.8.0 Stored XSS |
|---|
| الوصف | A stored cross-site scripting (XSS) vulnerability exists in Litemall versions ≤ 1.8.0 at the /wx/storage/upload endpoint. The application does not validate file extensions when processing uploaded files, allowing attackers to upload executable files such as .html, .htm, or .pdf. These files are then served back to clients directly without any sanitization, resulting in stored XSS. |
|---|
| المصدر | ⚠️ https://github.com/linlinjava/litemall/issues/567 |
|---|
| المستخدم | ez-lbz (UID 87033) |
|---|
| ارسال | 28/07/2025 07:26 AM (1 سنة منذ) |
|---|
| الاعتدال | 08/08/2025 05:44 PM (11 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 319266 [linlinjava litemall حتى 1.8.0 /wx/storage/upload file تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|