Ujcms v8.0.2 has a vulnerability that upload a pdf file with hidden Cross Site Scripting (XSS).
- Dominant language
- Java
- Stars
- 665
- Forks
- 114
- PR merge metrics
- No merged PRs in 30d
Description
[Vulnerability description]
Ujcms v8.0.2 has a vulnerability that upload a pdf file with hidden Cross Site Scripting (XSS).
[Vulnerability Type]
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
[Vendor of Product]
https://gitee.com/ujcms/ujcms
https://github.com/ujcms/ujcms
https://www.ujcms.com/
[Affected Product Code Base]
v8.0.2
[Vulnerability proof]
Condition: tomcat deployment project
1. we could upload this poc.
2. click view in edge.
[Repair suggestion]
1. We should filter the PDF file uploaded by the user to ensure that it does not contain malicious scripts and other content.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.