| タイトル | Omega Solution CoinEx Crypto latest Cross Site Scripting |
|---|
| 説明 | Omega Solution CoinEx Crypto 2025 contains a stored cross-site scripting (XSS) vulnerability in the ticket attachment upload functionality. The application accepts user-supplied SVG files without properly validating or sanitizing active content before storing and rendering them within the ticket system. An authenticated attacker can upload a crafted SVG file containing executable JavaScript that is subsequently executed in the security context of the application whenever the attachment is viewed by another user. Successful exploitation may allow execution of arbitrary client-side script, leading to session compromise, unauthorized actions performed on behalf of the victim, content manipulation, phishing attacks, or privilege escalation if the malicious attachment is viewed by privileged users such as support personnel or administrators.
Affected Component:
Ticket Attachment Upload
Affected Endpoint:
POST /user/ticket
Affected File Type:
SVG (.svg)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top 10 2021: A03 – Injection |
|---|
| ソース | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/27 |
|---|
| ユーザー | 4m3rr0r (UID 85795) |
|---|
| 送信 | 2026年07月17日 19:52 (3 月 ago) |
|---|
| モデレーション | 2026年10月03日 11:43 (3 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413348 [Omega Solution CoinEx Crypto 2025 Ticket Attachment Upload /user/ticket クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|