| शीर्षक | 北京珑大钜商科技有限公司 DBShop V3.3 Release 231225 Cross-Site Scripting (XSS) |
|---|
| विवरण | Summary
A reflected XSS (Cross-Site Scripting) vulnerability has been discovered in DBShop商城系统 V 3.3 Release 231225. The vulnerability allows for the execution of arbitrary HTML/javascript code, potentially resulting in the theft of sensitive user information.
Details
The vulnerability is located in My Orders in the User Center. $orderStatus is echoed directly on the page without filtering.
image
Proof of Concept (POC)
http(s)://your-ip/home-order?orderStatus=%22%3E%3Csvg%20onload=alert(5888)%3E |
|---|
| स्रोत | ⚠️ https://github.com/Hebing123/cve/issues/31 |
|---|
| उपयोगकर्ता | jiashenghe (UID 39445) |
|---|
| सबमिशन | 16/12/2024 07:57 AM (2 साल पहले) |
|---|
| संयम | 27/12/2024 09:49 AM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 289384 [Beijing Longda Jushang Technology DBShop商城系统 3.3 Release 231225 /home-order orderStatus क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|