| タイトル | 浩辰软件股份有限公司 (Gstarsoft Co., Ltd.) 浩辰CAD看图王 (GstarCAD Viewer Web) V9.4.0 Stored Cross-Site Scripting (XSS) |
|---|
| 説明 | The web-based version of GstarCAD Viewer V9.4.0 is vulnerable to a stored cross-site scripting (XSS) issue in the file renaming feature.
An attacker can inject malicious JavaScript code into the file name field. When the file list or renamed file is later rendered in the application, the injected code executes in the context of the victim’s browser.
In addition, if a maliciously renamed file is shared via link with other users, anyone opening the shared file will also be exposed to the injected payload, leading to a wider spread of the attack.
This vulnerability can lead to:
• Theft of sensitive user information (cookies, session tokens).
• Unauthorized actions on behalf of logged-in users.
• Persistent compromise of user accounts, since the payload is stored on the server.
• Secondary exploitation through shared links, extending the attack impact beyond the original environment. |
|---|
| ユーザー | BlackSpdier (UID 89912) |
|---|
| 送信 | 2025年09月11日 16:52 (1 年 ago) |
|---|
| モデレーション | 2025年09月28日 20:27 (17 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 326214 [Gstarsoft GstarCAD 迄 9.4.0 File Renaming クロスサイトスクリプティング] |
|---|
| ポイント | 17 |
|---|