Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Codiad v2.8.4 has a reflective XSS vulnerability #18

Open
Hebing123 opened this issue Feb 18, 2024 · 1 comment
Open

Codiad v2.8.4 has a reflective XSS vulnerability #18

Hebing123 opened this issue Feb 18, 2024 · 1 comment

Comments

@Hebing123
Copy link
Owner

Hebing123 commented Feb 18, 2024

Summary

** PRODUCT NOT SUPPORTED WHEN ASSIGNED **
Codiad v2.8.4 has a reflective cross-site vulnerability.

Details

Codiad v2.8.4 has a reflection cross-site attack vulnerability, the vulnerability is due to/components/market/dialog.php.
The reference "type" parameter is displayed directly in the front-end code without escaping.
https://github.com/Codiad/Codiad/blob/b2ef139219d2f931465f11306e651d3832262227/components/market/dialog.php#L103-L122
image
According to the picture, we know that in this code, the program references the value of the "type" parameter to the button label of the front-end code many times, but the "type" parameter is not filtered, so we can close the button label with double quotes and insert malicious code.

Proof of Concept (POC)

http://ip:port/components/market/dialog.php?action=list&note=undefined&type=%22%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
image

Impact

If a user or administrator accesses the malicious url, the cookie may be obtained by an attacker.

@Hebing123
Copy link
Owner Author

CVE-2024-26557

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant