| tiêu đề | Exrick xmall 1.1; source through 19e7917 Cross Site Scripting |
|---|
| Mô tả | Exrick xmall v1.1 and source through commit 19e7917d5ed3bd2a2421a3a246ad494c133ba94c contain a stored cross-site scripting vulnerability in administrative order printing. POST /member/addOrder in xmall-front-web accepts streetName and goodsList[*].productName from an unauthenticated request body; the front module only applies rate limiting and performs no session, token, or body.userId ownership validation. OrderServiceImpl.createOrder checks only that the supplied userId exists, then stores these values in tb_order_shipping.receiver_address and tb_order_item.title. When an authenticated backend operator views or prints the order, xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp inserts the stored address with jQuery .html() and the product title through HTML string concatenation. The cross-user data flow was successfully verified in an authorized local test environment; no executable payload is published. This issue is separate from CVE-2025-65540: that record covers member-list.jsp/member-show.jsp and member username/description, whereas this report uses a different input endpoint, database fields, backend page, and fix location. CWE-79. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Product: https://github.com/Exrick/xmall . Public disclosure/vendor notification: https://github.com/Exrick/xmall/issues/104 . |
|---|
| Nguồn | ⚠️ https://github.com/Exrick/xmall/issues/104 |
|---|
| Người dùng | JunRoinxxX (UID 100281) |
|---|
| Đệ trình | 01/08/2026 13:12 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 12/09/2026 18:06 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 403156 [Exrick xmall đến 19e7917d5ed3bd2a2421a3a246ad494c133ba94c Order Printing order-print.jsp Tập lệnh chéo trang] |
|---|
| điểm | 20 |
|---|