| Titel | LogicalDoc LogicalDoc Community 9.2.1 Injection |
|---|
| Beschreibung | Summary:
LogicalDOC v9.2.1 is affected by an HTML Injection vulnerability in the Administration Users interface. The Username, First Name, Last Name, Mobile, and Phone fields accept and store attacker-supplied HTML that is rendered in administrative user listing and detail views without proper output encoding or sanitization. An attacker with permission to create or edit users can inject HTML that is displayed to administrators, leading to UI defacement, misleading content, or potential escalation to stored XSS.
Steps to Reproduce:
1. Login as admin.
2. Navigate to http://x.x.x.x:8080/frontend.jsp and click on Administration.
3. Under Security click Users then Add User
4. Paste the following payload into any of these fields: First Name, Last Name, Mobile, or Phone: <h1>HTML Injection</h1>
5. Assign any group and click Save.
6. The injected HTML (<h1>HTML Injection</h1>) is rendered, confirming the HTML Injection.
Impact:
-) Attackers can alter the admin UI’s appearance or display misleading content.
-) Injected HTML can be used for phishing or social engineering.
-) May escalate to stored XSS, leading to session theft or unauthorized actions.
Recommendation:
-) Encode and sanitize all user-supplied input before rendering.
-) Validate inputs server-side and reject HTML tags in plain-text fields.
-) Apply a strict Content Security Policy and audit other modules for similar issues.
Affected Version:
LogicalDOC v9.2.1 |
|---|
| Quelle | ⚠️ https://gist.github.com/thezeekhan/7217e3612e658e130be7d84c82307652 |
|---|
| Benutzer | Zeeshan Khan (UID 91384) |
|---|
| Einreichung | 09.10.2025 19:56 (vor 1 Jahr) |
|---|
| Moderieren | 26.11.2025 18:59 (2 months later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 329026 [LogicalDOC Community Edition bis 9.2.1 Add Contact Page /frontend.jsp First Name/Last Name/Company/Address/Phone/Mobile Cross Site Scripting] |
|---|
| Punkte | 0 |
|---|