Changsha Developer Technology iView Editor Cross-Site Scripting Vulnerability in Markdown Handler

A cross-site scripting (XSS) vulnerability has been identified in Changsha Developer Technology iView Editor versions through 1.1.1. The issue arises in the Markdown Handler component, where user-controllable input is not properly sanitized before being output as a web page, allowing the injection of malicious scripts. This vulnerability can be exploited remotely, but requires authentication and user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a payload containing JavaScript into the Markdown Editor. The injected script will execute in the preview window. This vulnerability can be exploited by anyone with access to the editor.