| Titolo | quequnlong shiyi-blog 1.0.0 through 1.2.1; source through 4db96f9 Cross Site Scripting |
|---|
| Descrizione | A stored cross-site scripting vulnerability affects quequnlong shiyi-blog releases 1.0.0 (commit 9badd7bbe95fbee1dcdaa31156cf398caefe722d), 1.2 (d69c5ebc2c9a74e83473a6fb7c542b3801b8ac04), 1.2.1 (3ef9143fcf37c8fc8ec13241ef44f23c084d2554), and current source through commit 4db96f9ad6fdb53122e06610d8c3d55e88c5a580. An authenticated low-privilege user can submit controlled content to POST /chat/sendMsg. ChatServiceImpl assigns the logged-in sender and persists the text in chat_msg. SysChatMsgMapper.getChatMsgList returns the global message history without a conversation or recipient restriction, and WebSocketServer.sendAllMessage broadcasts to every online session. Other authenticated users render the stored message in blog-web/src/views/chat/index.vue through Vue v-html; current master also renders the latest-message preview with v-html. In versions 1.0.0 and 1.2 the formatter only replaces @ mentions. In 1.2.1 and current source it passes content through marked, but no allowlist sanitizer is applied before the HTML sink. Server-side sensitive-word replacement in current source is not an HTML sanitizer. Cross-account harmless triggering was confirmed in an authorized test environment; no executable payload is included. Attacker and victim are different accounts, so this is not self-XSS. CWE-79. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4). Product source: https://gitee.com/quequnlong/shiyi-blog . Public vendor report: https://gitee.com/quequnlong/shiyi-blog/issues/IK5RVL . This root is independent from CVE-2025-5513, which uses /api/comment/add and the comment display chain, and from Issue IK5RF6, which uses anonymous /api/message/add, sys_message, and the administrator message-management page. The input endpoint, persistence object, victim page, and fix locations are distinct. |
|---|
| Fonte | ⚠️ https://gitee.com/quequnlong/shiyi-blog/issues/IK5RVL |
|---|
| Utente | JunRoinxxX (UID 100281) |
|---|
| Sottomissione | 01/08/2026 09:15 (1 mese fa) |
|---|
| Moderazione | 12/09/2026 17:48 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 403149 [quequnlong shiyi-blog 1.0.0-1.2.1 chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList chat_msg cross site scripting] |
|---|
| Punti | 20 |
|---|