| शीर्षक | newbee-ltd newbee-mall <=1.0.0 Doubled Character XSS Manipulations |
|---|
| विवरण | In newbee-mall (<=1.0.0), the backend file upload functionality does not enforce a file extension whitelist. By uploading a polyglot image/HTML file, an attacker can bypass the BufferedImage validation, resulting in stored cross-site scripting (XSS).
代码定位：
- `controller/common/UploadController.java:49-81` —— 上传逻辑
- `config/NeeBeeMallWebMvcConfigurer.java:62-65` —— `/upload/**` 映射到本地目录
- `common/Constants.java:20` —— `FILE_UPLOAD_DIC = "D:\\upload\\"` |
|---|
| स्रोत | ⚠️ https://github.com/newbee-ltd/newbee-mall/issues/126 |
|---|
| उपयोगकर्ता | rockmelodeis (UID 100628) |
|---|
| सबमिशन | 27/08/2026 04:43 AM (24 दिन पहले) |
|---|
| संयम | 19/09/2026 11:41 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407974 [newbee-ltd newbee-mall तक 1.0.0 Goods Save Endpoint UploadController.java goodsName क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|