| शीर्षक | novel-plus novel-plus <=v4.2.0 Stored Cross-Site Scripting |
|---|
| विवरण | There is a stored XSS vulnerability in novel_front. When modifying the user name, although verification is done to limit the content of the user name, there is no verification or insufficient verification in the background, allowing attackers to modify the uploaded content through packet capture. This results in a stored XSS vulnerability,
At the same time, because the administrator did not perform verification when viewing the user list in the background, the malicious JS submitted by the attacker will be executed in the background. |
|---|
| स्रोत | ⚠️ https://github.com/JTZ-a/SRC/blob/master/novel-plus/storedXSS/en-us.md |
|---|
| उपयोगकर्ता | JTZ- (UID 59232) |
|---|
| सबमिशन | 28/12/2023 11:17 AM (3 साल पहले) |
|---|
| संयम | 28/12/2023 09:29 PM (10 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 249201 [Novel-Plus तक 4.2.0 HTTP POST Request /user/updateUserInfo nickName क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|