| Título | lceCMS lceCMS v 2.0.1 Long-lasting Cross Site Scripting |
|---|
| Descripción |
IceCMS is a content management system based on Spring Boot + Vue head-to-back.
IceCMS v2.0.1 has Long-lasting Cross Site Scripting, which is located in http://localhost:9528/planet user comments, which can lead to (1) stealing administrator accounts or cookies. The intruder can impersonate the administrator to log in to the backend, giving the intruder the ability to maliciously manipulate the backend data, including reading, changing, adding, and deleting some information. (2) Stealing the user's personal information or logging in to the account poses a huge threat to the user's security of the website. For example, impersonating a user to perform various actions. (3) Website trojans. Start by embedding the malicious code into the web application. When the user browses the Trojan page, the user's computer is implanted with a Trojan. (4) Sending advertisements or spam. Attackers can exploit XSS vulnerabilities to implant advertisements or send spam messages, seriously affecting users' normal use.
|
|---|
| Fuente | ⚠️ http://x.x.x.x/ |
|---|
| Usuario | zero121 (UID 59411) |
|---|
| Sumisión | 2023-12-01 09:36 (hace 3 años) |
|---|
| Moderación | 2023-12-01 17:39 (8 hours later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 246616 [Thecosy IceCMS 2.0.1 User Comment /planet secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 17 |
|---|