| 标题 | z-9527 admin ≤ commit 72aaf2d Cross Site Scripting |
|---|
| 描述 | A stored Cross-Site Scripting (XSS) vulnerability exists in Z-9527 Admin ≤ commit 72aaf2d at the message board functionality, where the /message/create endpoint accepts user-supplied message content without sanitization or validation, stores it directly in the database, and the React frontend renders this content using dangerouslySetInnerHTML without sanitization or validation. As a result, authenticated attackers can inject arbitrary JavaScript that executes in the browsers of users viewing the message board, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of victims. Mitigations include implementing HTML sanitization using libraries like DOMPurify, avoiding dangerouslySetInnerHTML in favor of safe React rendering, implementing Content Security Policy (CSP) headers, encoding output context-appropriately, and validating input against a whitelist of allowed HTML tags and attributes. |
|---|
| 来源 | ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-10 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-03-16 04時45分 (22 日前) |
|---|
| 管理 | 2026-03-31 18時11分 (16 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 354442 [z-9527 admin 1.0/2.0 Message Create Endpoint message.js 跨网站脚本] |
|---|
| 积分 | 20 |
|---|