Skip to content

There are several stored XSS vulnerabilities #112

Closed
@Quarkay

Description

Affected version: <= 3.3.0 (all versions yet)
Including Custom Edition I guess.

Usage of "v-html" tag should be really careful in vue. I found several unsafe usage in bbs-go webpage which data source might be from any user. It's necessary to filter the rich text before it is posted to the client. Otherwise it will be dangerous.

Here is the XSS attack example screenshot (one of them) :

XSS attack example

And the unsafe "v-html" tag for topic content (one of them) :

unsafe "v-html" tag

I will report the poc code after mlogclub team confirm and fix this defect.

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions