| عنوان | https://github.com/jeecgboot JeecgBoot 3.9.2 Cross Site Scripting |
|---|
| الوصف | JeecgBoot contains a stored Cross-Site Scripting (XSS) vulnerability caused by unauthorized file uploads. Anonymous attackers can directly access the unauthenticated upload interface /airag/chat/upload. The backend file validation allows file formats supporting JavaScript scripts such as SVG and HTML. Uploaded files are persistently stored on the server disk, and the framework’s static resource routing exposes the upload directory to public access, enabling any user to retrieve uploaded files directly.
An attacker may upload an SVG file embedded with malicious JavaScript. When other backend administrators visit the static resource link of this uploaded file, the browser will automatically execute the malicious script under the same origin context. This flaw allows theft of session cookies, account hijacking, and unauthorized invocation of sensitive backend APIs. Exploitation of this vulnerability requires no authentication, posing an extremely high security risk. |
|---|
| المصدر | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9773 |
|---|
| المستخدم | 0kam1 (UID 99762) |
|---|
| ارسال | 13/07/2026 05:12 PM (3 أشهر منذ) |
|---|
| الاعتدال | 29/08/2026 04:43 PM (2 months later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 391454 [JeecgBoot 3.9.2 /airag/chat/upload البرمجة عبر المواقع] |
|---|
| النقاط | 0 |
|---|