| 제목 | DedeCMS CMS V5.7.118 sys_admin_user_edit.php Reflected Cross Site Scripting |
|---|
| 설명 | A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the user deletion functionality of DedeCMS version V5.7.118. The userid parameter is reflected directly on the front-end without proper validation or sanitization, allowing the injection of malicious JavaScript code.
The application does not adequately handle user input, which enables the exploitation of this vulnerability. As a proof of concept (PoC), the following payload was used, which results in the execution of JavaScript code in the victim's browser:
"><img src=1 onerror=alert(1)>
An attacker can exploit this reflected XSS to perform malicious actions, such as redirecting the victim to fake websites (e.g., phishing pages), session theft, or executing arbitrary scripts in the context of the authenticated user.
As an example of a redirection payload, the following was used:
"><img src=1 onerror=window.location.href='https://www.google.com'> |
|---|
| 원천 | ⚠️ http://localhost/dedecms/dede/sys_admin_user_edit.php?id=4&userid=%22%3E%3Cimg%20src=1%20onerror=alert(1)%3E&dopost=delete |
|---|
| 사용자 | mirandaBR (UID 90010) |
|---|
| 제출 | 2026. 01. 30. AM 03:00 (8 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 01. AM 09:40 (2 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 185285 [DedeCMS 7.5 SP2 sys_admin_user_edit.php filename/mid/userid/templet 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|