SeaCMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in SeaCMS versions through 13.2. This issue allows attackers to perform reflected XSS attacks by exploiting the vid parameter in a specific route, potentially leading authenticated users to execute arbitrary JavaScript code.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the Upload/js/player/dmplayer/player route with a crafted vid parameter that includes JavaScript payloads, such as script tags or image tags with event handlers. The injected script will execute an alert as a demonstration of the XSS attack.