| タイトル | linlinjava litemall v1.4.0 through v1.8.0; source through a1ef964a Cross Site Scripting |
|---|
| 説明 | A stored cross-site scripting vulnerability affects linlinjava litemall releases v1.4.0, v1.5.0, v1.6.0, v1.7.0, v1.8.0, and current source through commit a1ef964a718b7277925b19ea26afe78ea3a1d325.
A backend user with admin:goods:create or admin:goods:update permission can persist attacker-controlled product detail markup through POST /admin/goods/create or POST /admin/goods/update. AdminGoodsService.validate checks the product name, serial number, brand, category, attributes, specifications, inventory, and price, but does not sanitize GoodsAllinone.goods.detail. LitemallGoodsService.add or updateById stores that value unchanged.
The public GET /wx/goods/detail endpoint returns the stored LitemallGoods object. The source explicitly states that users need not log in. litemall-vue/src/views/items/detail/index.vue inserts goods.info.detail at line 48 with v-html. Consequently an anonymous visitor opening the affected product page causes the stored markup to be parsed in the litemall frontend origin.
The initialization SQL defines an enabled Mall Administrator role with goods create and update permissions. Exploitation therefore does not require the super-administrator account, and the product editor can be separated from the anonymous victim. This is not self-XSS.
Harmless cross-user triggering was confirmed in an authorized local test environment. No executable payload is included. CWE-79. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4).
Product source: https://github.com/linlinjava/litemall
Public vendor report: https://gitee.com/linlinjava/litemall/issues/IK5SVR
No public record was found for this exact goods.detail to /wx/goods/detail to v-html chain. GitHub Issue #567 concerns upload and public serving of active files, with a different input, endpoint, storage object, and fix location. This goods issue is independent from the topic.content chain because it uses a different model field, write controller and service, default role, public route, affected-version lower bound, and fix location. |
|---|
| ソース | ⚠️ https://gitee.com/linlinjava/litemall/issues/IK5SVR |
|---|
| ユーザー | JunRoinxxX (UID 100281) |
|---|
| 送信 | 2026年08月01日 12:32 (1 月 ago) |
|---|
| モデレーション | 2026年09月12日 18:03 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 403155 [linlinjava litemall 迄 1.8.0 Product Detail index.vue AdminGoodsService.validate detail クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|