| 제목 | lceCMS lceCMS v 2.0.1 Long-lasting Cross Site Scripting |
|---|
| 설명 |
IceCMS is a content management system based on Spring Boot + Vue head-to-back.
IceCMS v2.0.1 has Long-lasting Cross Site Scripting, which is located in http://localhost:9528/planet user comments, which can lead to (1) stealing administrator accounts or cookies. The intruder can impersonate the administrator to log in to the backend, giving the intruder the ability to maliciously manipulate the backend data, including reading, changing, adding, and deleting some information. (2) Stealing the user's personal information or logging in to the account poses a huge threat to the user's security of the website. For example, impersonating a user to perform various actions. (3) Website trojans. Start by embedding the malicious code into the web application. When the user browses the Trojan page, the user's computer is implanted with a Trojan. (4) Sending advertisements or spam. Attackers can exploit XSS vulnerabilities to implant advertisements or send spam messages, seriously affecting users' normal use.
|
|---|
| 원천 | ⚠️ http://x.x.x.x/ |
|---|
| 사용자 | zero121 (UID 59411) |
|---|
| 제출 | 2023. 12. 01. AM 09:36 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 12. 01. PM 05:39 (8 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 246616 [Thecosy IceCMS 2.0.1 User Comment /planet 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|