| タイトル | z-9527 admin ≤ commit 72aaf2d Cross Site Scripting |
|---|
| 説明 | A stored Cross-Site Scripting (XSS) vulnerability exists in Z-9527 Admin ≤ commit 72aaf2d at the message board functionality, where the /message/create endpoint accepts user-supplied message content without sanitization or validation, stores it directly in the database, and the React frontend renders this content using dangerouslySetInnerHTML without sanitization or validation. As a result, authenticated attackers can inject arbitrary JavaScript that executes in the browsers of users viewing the message board, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of victims. Mitigations include implementing HTML sanitization using libraries like DOMPurify, avoiding dangerouslySetInnerHTML in favor of safe React rendering, implementing Content Security Policy (CSP) headers, encoding output context-appropriately, and validating input against a whitelist of allowed HTML tags and attributes. |
|---|
| ソース | ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-10 |
|---|
| ユーザー | Anonymous User |
|---|
| 送信 | 2026年03月16日 04:45 (19 日 ago) |
|---|
| モデレーション | 2026年03月31日 18:11 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 354442 [z-9527 admin 1.0/2.0 Message Create Endpoint message.js クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|