| 제목 | Omega Solution CoinEx Crypto latest Cross Site Scripting |
|---|
| 설명 | Omega Solution CoinEx Crypto 2025 contains a stored cross-site scripting (XSS) vulnerability in the ticket attachment upload functionality. The application accepts user-supplied SVG files without properly validating or sanitizing active content before storing and rendering them within the ticket system. An authenticated attacker can upload a crafted SVG file containing executable JavaScript that is subsequently executed in the security context of the application whenever the attachment is viewed by another user. Successful exploitation may allow execution of arbitrary client-side script, leading to session compromise, unauthorized actions performed on behalf of the victim, content manipulation, phishing attacks, or privilege escalation if the malicious attachment is viewed by privileged users such as support personnel or administrators.
Affected Component:
Ticket Attachment Upload
Affected Endpoint:
POST /user/ticket
Affected File Type:
SVG (.svg)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top 10 2021: A03 – Injection |
|---|
| 원천 | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/27 |
|---|
| 사용자 | 4m3rr0r (UID 85795) |
|---|
| 제출 | 2026. 07. 17. PM 07:52 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 03. AM 11:43 (3 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413348 [Omega Solution CoinEx Crypto 2025 Ticket Attachment Upload /user/ticket 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|