XSS issue in the "Text" parameter (forums)

[trungtin1998]

nopCommerce version: 4.50.1

Description: A stored cross-site scripting (XSS) vulnerability exists when creating a new post of nopCommerce version 4.50.1 that allows a remote attacker to execute arbitrary JavaScript code at client browser
Steps to reproduce the problem:

• Step 1: Create new topic or reply topic with injecting [url]javascript:alert(document.domain)[/url] to "Text" parameter
  
• Step2: Click a text javascript:alert(document.domain) at topic that was created in step 1 to trigger XSS
  
  Let me know if you require additional information.

[skoshelev]

Hi @trungtin1998. Thank you for your help. We fixed this problem by this commit

[trungtin1998]

Hi guys, Can you help me request CVE for this issue?

[AndreiMaz]

@trungtin1998 Please feel free to report it at https://www.cve.org/

But our team will appreciate if you do after the next version release of nopCommerce (we plan to release a minor version in April)

[trungtin1998]

Hi @AndreiMaz, thank you for your information. I will do it after the next version release of nopCommerce.