| 제목 | 浩辰软件股份有限公司 (Gstarsoft Co., Ltd.) 浩辰CAD看图王 (GstarCAD Viewer Web) V9.4.0 Stored Cross-Site Scripting (XSS) |
|---|
| 설명 | The web-based version of GstarCAD Viewer V9.4.0 is vulnerable to a stored cross-site scripting (XSS) issue in the file renaming feature.
An attacker can inject malicious JavaScript code into the file name field. When the file list or renamed file is later rendered in the application, the injected code executes in the context of the victim’s browser.
In addition, if a maliciously renamed file is shared via link with other users, anyone opening the shared file will also be exposed to the injected payload, leading to a wider spread of the attack.
This vulnerability can lead to:
• Theft of sensitive user information (cookies, session tokens).
• Unauthorized actions on behalf of logged-in users.
• Persistent compromise of user accounts, since the payload is stored on the server.
• Secondary exploitation through shared links, extending the attack impact beyond the original environment. |
|---|
| 사용자 | BlackSpdier (UID 89912) |
|---|
| 제출 | 2025. 09. 11. PM 04:52 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 09. 28. PM 08:27 (17 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 326214 [Gstarsoft GstarCAD 까지 9.4.0 File Renaming 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|