| 제목 | DedeCMS V5.7.116 Cross Site Scripting |
|---|
| 설명 | Summary
A stored XSS vulnerability has been identified in DedeCMS V5.7.116.
Attackers can exploit this vulnerability by maliciously inserting an XSS payload in the comment section during the purchase of goods.
Details
The vulnerability is located in the file plus/carbuyaction.php. Our analysis indicates that all parameters are passed through the RemoveXSS method.
However, our payload can bypass the RemoveXSS method's filtering for XSS vulnerabilities, thus any script that relies solely on the RemoveXSS method to filter parameter values and displays these values on the page is vulnerable.
Steps
The attacker, posing as a regular user, purchases goods and adds a malicious comment.
An administrator opens the order details in the backend, triggering the stored XSS vulnerability. |
|---|
| 원천 | ⚠️ https://github.com/Hebing123/cve/issues/79 |
|---|
| 사용자 | jiashenghe (UID 39445) |
|---|
| 제출 | 2024. 11. 28. AM 04:04 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 12. 04. PM 05:31 (7 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 286905 [DedeCMS 5.7.116 HTTP POST Request /plus/carbuyaction.php RemoveXSS 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|