| 제목 | Code-Projects ONLINE MUSIC SITE V1.0 Storage XSS vulnerability |
|---|
| 설명 | A Storage XSS vulnerability was found in the "AdminAddAlbum.php" file of the "ONLINE MUSIC SITE" project. Root Cause Because AdminAddAlbum.php does not escape, clean or parameterize the POST request data submitted, when the attacker submits a malicious Payload in the txtalbum, txtsinger, txtwriter field (for example,"<img src=x onerror=alert(1)>"), the code does not block it and permanently stores it in the "tblalbum" table of the database. When “AdminAddAlbum.php” reads the malicious txtalbum, txtsinger, txtwriter data in the database, and original data to an HTML page as-is, the browser will <script>treat the HTML tag and execute its content. Immediate corrective actions are essential to safeguard system security and uphold data integrity.
|
|---|
| 원천 | ⚠️ https://github.com/yuji0903/silver-guide/issues/9 |
|---|
| 사용자 | yu_ji (UID 94509) |
|---|
| 제출 | 2026. 02. 05. AM 04:34 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 08. AM 09:17 (3 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 344930 [code-projects for Plugin 1.0 AdminAddAlbum.php txtalbum 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|