Technical-Laohu Mpay Cross-Site Scripting Vulnerability in User Center Component

A stored cross-site scripting vulnerability has been identified in Technical-Laohu Mpay versions through 1.2.4. The issue arises in the User Center component, specifically within an unknown function that handles nickname modifications. This vulnerability allows for the injection of malicious scripts that are permanently stored and can be executed in the context of other users, potentially leading to the theft of sensitive information, manipulation of page content, and distribution of malware. The vulnerability can be exploited remotely, but requires authentication and user interaction.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.