Iteaj iBoot File Upload Vulnerability Leading to Cross-Site Scripting

A cross-site scripting vulnerability has been identified in Iteaj iBoot version 1.1.3, specifically within the file upload component. The issue arises in the '/common/upload/batch' interface, where the application improperly processes uploaded files, allowing the inclusion of malicious scripts. This vulnerability can be exploited remotely, with the uploaded files being accessible via the application's image upload directory.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the '/common/upload/batch' endpoint with a file that has an '.html' extension. The file should contain a script tag with a JavaScript payload, such as an alert. Once the file is uploaded, it can be accessed through the application's image upload directory, where the injected script will be executed.