StarSea99 starsea-mall Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in StarSea99 starsea-mall version 1.0. This issue arises in the Backend component, specifically within the file '/admin/indexConfigs/save'. The vulnerability is triggered by manipulating the 'categoryName' argument, which allows for the injection of malicious HTML or JavaScript. This vulnerability can be exploited remotely, but requires authentication and user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the '/admin/indexConfigs/save' endpoint. Once there, inject a script or HTML payload into the 'categoryName' argument. After submitting the form, the injected content will be executed as a script, demonstrating the cross-site scripting vulnerability.