| 标题 | lceCMS lceCMS v 2.0.1 Long-lasting Cross Site Scripting |
|---|
| 描述 |
IceCMS is a content management system based on Spring Boot + Vue head-to-back.
IceCMS v2.0.1 has Long-lasting Cross Site Scripting, which is located in http://localhost:9528/planet user comments, which can lead to (1) stealing administrator accounts or cookies. The intruder can impersonate the administrator to log in to the backend, giving the intruder the ability to maliciously manipulate the backend data, including reading, changing, adding, and deleting some information. (2) Stealing the user's personal information or logging in to the account poses a huge threat to the user's security of the website. For example, impersonating a user to perform various actions. (3) Website trojans. Start by embedding the malicious code into the web application. When the user browses the Trojan page, the user's computer is implanted with a Trojan. (4) Sending advertisements or spam. Attackers can exploit XSS vulnerabilities to implant advertisements or send spam messages, seriously affecting users' normal use.
|
|---|
| 来源 | ⚠️ http://x.x.x.x/ |
|---|
| 用户 | zero121 (UID 59411) |
|---|
| 提交 | 2023-12-01 09時36分 (3 年前) |
|---|
| 管理 | 2023-12-01 17時39分 (8 hours later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 246616 [Thecosy IceCMS 2.0.1 User Comment /planet 跨网站脚本] |
|---|
| 积分 | 17 |
|---|