A stored XSS vulnerability exists in the file template editing of ujcms_v9.7.5.
- Dominant language
- Java
- Stars
- 665
- Forks
- 114
- PR merge metrics
- No merged PRs in 30d
Description
【Vulnerability Description】
There is a vulnerability in the template file editing function of the ujcms_v9.7.5 backend. The embedded JavaScript is not filtered or checked. When users access files with embedded malicious code, the malicious JavaScript code will be triggered, which may lead to the theft of sensitive tokens.
【Vulnerability Type】
CWE-79: Cross-site Scripting
【Product Vendor】
https://gitee.com/ujcms/ujcms
https://github.com/ujcms/ujcms
https://www.ujcms.com/
【Affected Product Code Repository】
ujcms_v9.7.5
【Vulnerability Proof】
Edit template file
【Code Location】
/main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java#update
【Code Analysis】
The updated file content is saved without verification
【Repair Suggestions】
Perform security checks on the updated file content
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.