| शीर्षक | LogicalDoc LogicalDoc Community 9.2.1 Injection |
|---|
| विवरण | Summary:
LogicalDOC v9.2.1 is affected by an HTML Injection vulnerability in the Administration Users interface. The Username, First Name, Last Name, Mobile, and Phone fields accept and store attacker-supplied HTML that is rendered in administrative user listing and detail views without proper output encoding or sanitization. An attacker with permission to create or edit users can inject HTML that is displayed to administrators, leading to UI defacement, misleading content, or potential escalation to stored XSS.
Steps to Reproduce:
1. Login as admin.
2. Navigate to http://x.x.x.x:8080/frontend.jsp and click on Administration.
3. Under Security click Users then Add User
4. Paste the following payload into any of these fields: First Name, Last Name, Mobile, or Phone: <h1>HTML Injection</h1>
5. Assign any group and click Save.
6. The injected HTML (<h1>HTML Injection</h1>) is rendered, confirming the HTML Injection.
Impact:
-) Attackers can alter the admin UI’s appearance or display misleading content.
-) Injected HTML can be used for phishing or social engineering.
-) May escalate to stored XSS, leading to session theft or unauthorized actions.
Recommendation:
-) Encode and sanitize all user-supplied input before rendering.
-) Validate inputs server-side and reject HTML tags in plain-text fields.
-) Apply a strict Content Security Policy and audit other modules for similar issues.
Affected Version:
LogicalDOC v9.2.1 |
|---|
| स्रोत | ⚠️ https://gist.github.com/thezeekhan/7217e3612e658e130be7d84c82307652 |
|---|
| उपयोगकर्ता | Zeeshan Khan (UID 91384) |
|---|
| सबमिशन | 09/10/2025 07:56 PM (1 वर्ष पहले) |
|---|
| संयम | 26/11/2025 06:59 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 329026 [LogicalDOC Community Edition तक 9.2.1 Add Contact Page /frontend.jsp First Name/Last Name/Company/Address/Phone/Mobile क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|