| 제목 | fastadminnet fastadmin 1.2.0.20210401_beta Cross Site Scripting |
|---|
| 설명 | A reflected cross-site scripting (XSS) vulnerability exists in FastAdmin (fastadminnet/fastadmin) versions up to and including v1.2.0.20210401_beta, an open-source admin framework based on ThinkPHP. The vulnerability resides in the front-end user controller at application/index/controller/User.php. Both the register() function (line 68) and the login() function (line 146) accept a user-supplied "url" GET parameter filtered only by trim(), with no HTML sanitization. This value is assigned to the template and rendered directly via {$url} (no encoding modifier) into a double-quoted HTML attribute in the login and register page templates (application/index/view/user/login.html line 7 and register.html line 8). ThinkPHP applies no HTML encoding when a variable is output without a modifier, leaving the double-quote (") unescaped and allowing attribute context escape. An unauthenticated remote attacker can craft a malicious URL such as /index/user/register.html?url=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E and trick a victim into visiting it, causing arbitrary JavaScript to execute in the victim's browser. This enables session cookie theft, credential phishing, and malicious redirects. No authentication is required to exploit this vulnerability. The vulnerability was fixed in v1.2.1.20210731_beta (commit b3d32e2) by adding the htmlentities modifier to the template output. |
|---|
| 원천 | ⚠️ https://lhzzz08.github.io/posts/cveapplication4/ |
|---|
| 사용자 | zzl08 (UID 93909) |
|---|
| 제출 | 2026. 07. 21. PM 05:52 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 06. AM 11:35 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399399 [FastAdmin 까지 1.2.0.20210401_beta User Controller User.php register/login url 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|