| عنوان | y_project RuoYi 4.8.3 Cross Site Scripting |
|---|
| الوصف | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xssRuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by stored cross-site scripting in the dictionary-data drawer preview.
A user with system:dict:add can persist cssClass through POST /system/dict/data/add. The field has a length check only. The default XSS filter (xss.enabled=true) strips tags but keeps double quotes. The v4.8.3 renderDrawer() function concatenates cssClass into <span class="..."> and parses it with jQuery .html(). A quote can close the class attribute and add an event handler.
A local Docker test stored cssClass=x" onmouseover="document.body.dataset.cveProbe=1 with a non-admin ry account. After an administrator opened /system/dict and the sys_normal_disable drawer, the DOM contained <span class="x" onmouseover="document.body.dataset.cveProbe=1">E2E_XSS_PROBE</span>. Dispatching mouseover set document.body.dataset.cveProbe to 1.
This is distinct from RuoYi issues 212, 308, 320, and 329, which use other fields and sinks. v4.8.2 does not contain this drawer path.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| المصدر | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-dictionary-preview-stored-xss |
|---|
| المستخدم | bobtao666 (UID 100998) |
|---|
| ارسال | 06/09/2026 05:59 PM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 11:36 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416579 [y_project RuoYi حتى 4.8.3 Dictionary Data Drawer Preview /system/dict/data/add renderDrawer cssClass البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|