| タイトル | linlinjava litemall v1.5.0 through v1.8.0; source through a1ef964a Cross Site Scripting |
|---|
| 説明 | A stored cross-site scripting vulnerability affects linlinjava litemall releases v1.5.0, v1.6.0, v1.7.0, v1.8.0, and current source through commit a1ef964a718b7277925b19ea26afe78ea3a1d325.
A backend user with admin:topic:create or admin:topic:update permission can persist attacker-controlled content through POST /admin/topic/create or POST /admin/topic/update. AdminTopicController.validate only checks that LitemallTopic.content is non-empty. LitemallTopicService.add and updateById then store the value without HTML sanitization or output encoding.
The public GET /wx/topic/detail endpoint returns the stored topic object. Its @LoginUser parameter is optional. litemall-vue/src/views/items/topic/index.vue inserts topic.content at line 4 with v-html. Consequently an anonymous visitor opening the affected topic page causes the stored markup to be parsed in the litemall frontend origin.
The initialization SQL defines an enabled Promotion Administrator role with topic create and update permissions. Exploitation therefore does not require the super-administrator account, and the topic editor can be separated from the anonymous victim. This is not self-XSS.
Harmless cross-user triggering was confirmed in an authorized local test environment. No executable payload is included. CWE-79. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4).
Product source: https://github.com/linlinjava/litemall
Public vendor report: https://gitee.com/linlinjava/litemall/issues/IK5SUU
No public record was found for this exact topic.content to /wx/topic/detail to v-html chain. GitHub Issue #567 concerns upload and public serving of active files, with a different input, endpoint, storage object, and fix location. This topic issue is also independent from the goods.detail chain because it uses a different model field, write controller, default role, public route, version lower bound, and fix location. |
|---|
| ソース | ⚠️ https://gitee.com/linlinjava/litemall/issues/IK5SUU |
|---|
| ユーザー | JunRoinxxX (UID 100281) |
|---|
| 送信 | 2026年08月01日 12:27 (1 月 ago) |
|---|
| モデレーション | 2026年09月12日 18:03 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 403154 [linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0 Admin Topic index.vue AdminTopicController.validate クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|