| शीर्षक | https://github.com/iJason-Liu/Books_Manager Books_Manager 1.0 Stored XSS |
|---|
| विवरण | ulnerability Introduction
controllers/books_center/add_book_check.php interface has an XSS storage vulnerability, where attackers can pass in the product name (i.e. mark parameter) to cause the server to execute JS code, resulting in an XSS storage vulnerability
Vulnerability analysis
Vulnerability class file: Books_Manager/books_center/add_book_check.php
Receiving the mark parameter in the add_book_check.php and directly updating it to the database without verifying the incoming content, there is an XSS storage vulnerability
Vulnerability reproduction
After entering the following code in the product name and clicking the submit button, it was found that the JS code was successfully executed.
|
|---|
| स्रोत | ⚠️ https://blog.y1fan.work/2026/01/13/%E5%AD%98%E5%82%A8%E5%9E%8Bxss/ |
|---|
| उपयोगकर्ता | y1fan (UID 94467) |
|---|
| सबमिशन | 13/01/2026 09:00 AM (9 महीनों पहले) |
|---|
| संयम | 26/01/2026 03:53 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 342873 [iJason-Liu Books_Manager तक 298ba736387ca37810466349af13a0fdf828e99c add_book_check.php mark क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|