| 제목 | DedeCMS CMS V5.7.118 Cross Site Scripting |
|---|
| 설명 | In DedeCMS V5.7.118, a Cross-Site Scripting (XSS) vulnerability exploitable through the search field functionality, as presented in the action_search.php file, was identified. The flaw occurs due to the lack of proper validation and sanitization of user-supplied data, allowing the injection of malicious JavaScript code.
An attacker can exploit this vulnerability by inserting an XSS payload directly into the search field, causing the injected code to be processed and executed in the victim's browser when a request is handled or a response is displayed. As a proof of concept (PoC), the following payload was successfully executed: <script>alert(1)</script>
Upon submitting this payload through the search functionality, the JavaScript code is successfully executed, resulting in an alert being displayed in the browser, confirming the exploitation of the XSS vulnerability. |
|---|
| 원천 | ⚠️ http://localhost/dedecms/dede/ |
|---|
| 사용자 | mirandaBR (UID 90010) |
|---|
| 제출 | 2026. 01. 29. AM 03:02 (8 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 01. AM 09:20 (3 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 175098 [DeDeCMS 5.7 SP2 action_search.php keyword 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|