| Titel | TDuckCloud tduck-platform 5.3 Cross Site Scripting |
|---|
| Beschreibung | Stored cross-site scripting (CWE-79) in TDuckCloud tduck-platform / TDuck Survey Community Edition 5.3. An authenticated form owner can persist attacker-controlled HTML in the submitShowCustomPageContent field through POST /user/form/setting/save. The save path checks FormAuthUtils.hasPermission(formKey), so the attacker must own the affected form. The setting is stored in fm_user_form_setting.settings and returned by the public /user/form/public/settings/{key} endpoint. After an unauthenticated visitor submits that public form, the frontend enters the submission-success state and renders submitShowCustomPageContent with Vue v-html in tduck-front/src/views/form/write/index.vue:21. This causes script execution in the anonymous visitor's browser context. The complete form-owner-to-anonymous-visitor flow was confirmed in an authorized test deployment; no executable payload is included in this submission. Affected field: submitShowCustomPageContent. Write endpoint: POST /user/form/setting/save. Public read endpoint: /user/form/public/settings/{key}. Sink: tduck-front/src/views/form/write/index.vue:21. Backend controller: tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormSettingController.java. CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4). Product source: https://gitee.com/TDuckApp/tduck-platform. Frontend version-5 commit: https://gitee.com/TDuckApp/tduck-front/tree/4bb750bb8bcadb01a260d1f22f780e523bd3b17f. Current frontend master commit 257932566963fb0a3e70e9d40c837689bc2878c0 and backend master commit ea7f0fae7cb0fd998a3284c11addce689350cd69 retain the same data flow. The vendor was contacted publicly on 2026-08-01 at https://gitee.com/TDuckApp/tduck-platform/issues/IK5RJD. No fixed version is known. |
|---|
| Quelle | ⚠️ https://gitee.com/TDuckApp/tduck-platform/issues/IK5RJD |
|---|
| Benutzer | JunRoinxxX (UID 100281) |
|---|
| Einreichung | 01.08.2026 08:11 (vor 1 Monat) |
|---|
| Moderieren | 12.09.2026 13:03 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 403118 [TDuckApp tduck-platform bis 5.3 Form Write View index.vue submitShowCustomPageContent Cross Site Scripting] |
|---|
| Punkte | 20 |
|---|