| 标题 | Omega Solution CoinEx Crypto latest Cross Site Scripting |
|---|
| 描述 | Omega Solution CoinEx Crypto 2025 contains a stored cross-site scripting (XSS) vulnerability in the ticket attachment upload functionality. The application accepts user-supplied SVG files without properly validating or sanitizing active content before storing and rendering them within the ticket system. An authenticated attacker can upload a crafted SVG file containing executable JavaScript that is subsequently executed in the security context of the application whenever the attachment is viewed by another user. Successful exploitation may allow execution of arbitrary client-side script, leading to session compromise, unauthorized actions performed on behalf of the victim, content manipulation, phishing attacks, or privilege escalation if the malicious attachment is viewed by privileged users such as support personnel or administrators.
Affected Component:
Ticket Attachment Upload
Affected Endpoint:
POST /user/ticket
Affected File Type:
SVG (.svg)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top 10 2021: A03 – Injection |
|---|
| 来源 | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/27 |
|---|
| 用户 | 4m3rr0r (UID 85795) |
|---|
| 提交 | 2026-07-17 19時52分 (3 月前) |
|---|
| 管理 | 2026-10-03 11時43分 (3 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 413348 [Omega Solution CoinEx Crypto 2025 Ticket Attachment Upload /user/ticket 跨网站脚本] |
|---|
| 积分 | 20 |
|---|