Tmall Demo Stored Cross-Site Scripting Vulnerability
Vulnerability
A stored cross-site scripting vulnerability has been identified in Tmall Demo versions prior to 20250505. The issue resides in the Product Details Page component, specifically within the /tmall/admin/ directory. This vulnerability allows for the injection of malicious scripts through the Product Name/Product Title argument, which could be executed in the context of the user.
Impact
Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.
Remediation
It is recommended to filter data input from the front end and perform HTML entity encoding on data before it is echoed to the front end.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.