Quequnlong Shiyi-Blog Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Quequnlong Shiyi-Blog versions through 1.2.1. The issue arises in the '/dev-api/api/comment/add' endpoint, where improper handling of the 'content' parameter allows for the injection of malicious scripts. This vulnerability can be exploited remotely, with the potential for the injected script to execute in the context of the user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into the Shiyi-Blog application and navigate to an article. Use the comment feature to inject a script into the 'content' parameter. Once the comment is posted, the script will execute, demonstrating the cross-site scripting vulnerability.