| Название | linlinjava litemall ≤v1.8.0 Stored XSS |
|---|
| Описание | A stored cross-site scripting (XSS) vulnerability exists in Litemall versions ≤ 1.8.0 at the /wx/storage/upload endpoint. The application does not validate file extensions when processing uploaded files, allowing attackers to upload executable files such as .html, .htm, or .pdf. These files are then served back to clients directly without any sanitization, resulting in stored XSS. |
|---|
| Источник | ⚠️ https://github.com/linlinjava/litemall/issues/567 |
|---|
| Пользователь | ez-lbz (UID 87033) |
|---|
| Представление | 28.07.2025 07:26 (1 Год назад) |
|---|
| Модерация | 08.08.2025 17:44 (11 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 319266 [linlinjava litemall до 1.8.0 /wx/storage/upload file эскалация привилегий] |
|---|
| Баллы | 19 |
|---|