| 제목 | linlinjava litemall ≤v1.8.0 Stored XSS |
|---|
| 설명 | A stored cross-site scripting (XSS) vulnerability exists in Litemall versions ≤ 1.8.0 at the /wx/storage/upload endpoint. The application does not validate file extensions when processing uploaded files, allowing attackers to upload executable files such as .html, .htm, or .pdf. These files are then served back to clients directly without any sanitization, resulting in stored XSS. |
|---|
| 원천 | ⚠️ https://github.com/linlinjava/litemall/issues/567 |
|---|
| 사용자 | ez-lbz (UID 87033) |
|---|
| 제출 | 2025. 07. 28. AM 07:26 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 08. 08. PM 05:44 (11 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 319266 [linlinjava litemall 까지 1.8.0 /wx/storage/upload file 권한 상승] |
|---|
| 포인트들 | 19 |
|---|