| 标题 | linlinjava litemall ≤v1.8.0 Stored XSS |
|---|
| 描述 | A stored cross-site scripting (XSS) vulnerability exists in Litemall versions ≤ 1.8.0 at the /wx/storage/upload endpoint. The application does not validate file extensions when processing uploaded files, allowing attackers to upload executable files such as .html, .htm, or .pdf. These files are then served back to clients directly without any sanitization, resulting in stored XSS. |
|---|
| 来源 | ⚠️ https://github.com/linlinjava/litemall/issues/567 |
|---|
| 用户 | ez-lbz (UID 87033) |
|---|
| 提交 | 2025-07-28 07時26分 (1 年前) |
|---|
| 管理 | 2025-08-08 17時44分 (11 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 319266 [linlinjava litemall 直到 1.8.0 /wx/storage/upload file 权限提升] |
|---|
| 积分 | 19 |
|---|