My-Blog icon indicating copy to clipboard operation
My-Blog copied to clipboard
verified publisher icon ZHENFENG13

Stored XSS - Add Tag

Open NinjaGPT opened this issue 5 months ago • 0 comments

Summary

The endpoint /admin/tags/save does not perform strict validation on user-controlled input, thus allowing attackers to insert malicious code into the database. When outputting content at the endpoint /admin/tags, no encoding is performed either, resulting in a stored XSS vulnerability.

Additionally, this application has no CSRF protection, enabling attackers to exploit CSRF to trick admin users into adding tag names containing malicious code.

POC

  • /admin/tags/save
Image

SINK

  • /admin/tags
Image

NinjaGPT avatar Jul 26 '25 07:07 NinjaGPT