Itwanger Paicoding Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Itwanger Paicoding version 1.0.3. The issue arises in the '/article/app/post' interface, where the 'content' parameter is not properly sanitized before being displayed to users. This flaw allows attackers to inject malicious scripts that could be executed in the context of the user viewing the article. Exploitation of this vulnerability could lead to the theft of cookies, facilitating phishing attacks or the spread of worms.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log in as an administrator and navigate to the article posting interface. Inject a script payload into the 'content' parameter and submit the article. Once published, the injected script will execute when the article is viewed, demonstrating the cross-site scripting vulnerability.