| Название | 浩辰软件股份有限公司 (Gstarsoft Co., Ltd.) 浩辰CAD看图王 (GstarCAD Viewer Web) V9.4.0 Stored Cross-Site Scripting (XSS) |
|---|
| Описание | The web-based version of GstarCAD Viewer V9.4.0 is vulnerable to a stored cross-site scripting (XSS) issue in the file renaming feature.
An attacker can inject malicious JavaScript code into the file name field. When the file list or renamed file is later rendered in the application, the injected code executes in the context of the victim’s browser.
In addition, if a maliciously renamed file is shared via link with other users, anyone opening the shared file will also be exposed to the injected payload, leading to a wider spread of the attack.
This vulnerability can lead to:
• Theft of sensitive user information (cookies, session tokens).
• Unauthorized actions on behalf of logged-in users.
• Persistent compromise of user accounts, since the payload is stored on the server.
• Secondary exploitation through shared links, extending the attack impact beyond the original environment. |
|---|
| Пользователь | BlackSpdier (UID 89912) |
|---|
| Представление | 11.09.2025 16:52 (1 Год назад) |
|---|
| Модерация | 28.09.2025 20:27 (17 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 326214 [Gstarsoft GstarCAD до 9.4.0 File Renaming межсайтовый скриптинг] |
|---|
| Баллы | 17 |
|---|