| शीर्षक | Wuxi Wubang Security Software Co., Ltd. Wubang 'Five-in-One' Safety Production Management Information System V3.5 Improper Neutralization of Alternate XSS Syntax |
|---|
| विवरण | During code audit, an unauthenticated arbitrary file upload endpoint was identified. The endpoint lacks authentication and authorization checks and does not enforce an effective allowlist on file extension, MIME type, or file content. An attacker can directly upload arbitrary XML files. The uploaded XML file is persistently stored on the server and later read, parsed, and displayed in the admin panel or business frontend. Because the frontend does not HTML-entity-encode XML node content before rendering it to the DOM and directly uses innerHTML, an attacker can embed malicious HTML/JavaScript in XML nodes. When an administrator or normal user visits the page containing the XML data, the malicious script executes in the victim's browser context, resulting in stored XSS. This vulnerability can lead to session token/cookie theft, unauthorized administrative actions, sensitive information disclosure, and worm-like propagation. To remediate, add authentication and authorization checks to the upload endpoint, restrict file types and rename/isolate stored files, disable external entities when parsing XML, uniformly encode frontend output, and configure CSP and other mitigations.
|
|---|
| स्रोत | ⚠️ https://github.com/Rookie506/CVE/issues/1 |
|---|
| उपयोगकर्ता | Jreey563 (UID 96485) |
|---|
| सबमिशन | 17/09/2026 11:10 AM (1 महीना पहले) |
|---|
| संयम | 19/10/2026 02:37 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422321 [Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|