Mini-Tmall Cross-Site Scripting Vulnerability in Admin Component

A cross-site scripting (XSS) vulnerability has been identified in Mini-Tmall versions prior to 20250211. The issue resides in the Admin Name Handler component, specifically within the /admin file. This vulnerability allows remote attackers to inject malicious scripts, which could be executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the admin panel of a Mini-Tmall installation prior to 20250211. Enter a script payload into the relevant module, which will trigger the cross-site scripting vulnerability by executing the injected script.