| Название | Wuxi Wubang Security Software Co., Ltd. Wubang 'Five-in-One' Safety Production Management Information System V3.5 Improper Neutralization of Alternate XSS Syntax |
|---|
| Описание | During code audit, an unauthenticated arbitrary file upload endpoint was identified. The endpoint lacks authentication and authorization checks and does not enforce an effective allowlist on file extension, MIME type, or file content. An attacker can directly upload arbitrary XML files. The uploaded XML file is persistently stored on the server and later read, parsed, and displayed in the admin panel or business frontend. Because the frontend does not HTML-entity-encode XML node content before rendering it to the DOM and directly uses innerHTML, an attacker can embed malicious HTML/JavaScript in XML nodes. When an administrator or normal user visits the page containing the XML data, the malicious script executes in the victim's browser context, resulting in stored XSS. This vulnerability can lead to session token/cookie theft, unauthorized administrative actions, sensitive information disclosure, and worm-like propagation. To remediate, add authentication and authorization checks to the upload endpoint, restrict file types and rename/isolate stored files, disable external entities when parsing XML, uniformly encode frontend output, and configure CSP and other mitigations.
|
|---|
| Источник | ⚠️ https://github.com/Rookie506/CVE/issues/1 |
|---|
| Пользователь | Jreey563 (UID 96485) |
|---|
| Представление | 17.09.2026 11:10 (1 месяц назад) |
|---|
| Модерация | 19.10.2026 14:37 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 422321 [Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|