ContiNew Admin Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in ContiNew Admin versions through 3.6.0. The issue arises in an unknown function of the file '/dev-api/common/file', where improper handling of the 'File' argument allows for the injection of malicious scripts. This vulnerability can be exploited remotely, and the details of the exploit have been made public.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, upload a file containing a script payload in HTML format through the '/dev-api/common/file' interface. After the file is uploaded, access it to trigger the execution of the injected script, demonstrating the cross-site scripting vulnerability.