1024-lab SmartAdmin Stored Cross-Site Scripting Vulnerability in Help Documentation Module

A stored cross-site scripting vulnerability has been identified in 1024-lab/lab1024 SmartAdmin versions through 3.29. The issue resides in the Help Documentation module, specifically within the file 'sa-base/src/main/java/net/lab1024/sa/base/module/support/helpdoc/domain/form/HelpDocAddForm.java'. This vulnerability allows attackers to inject malicious HTML, including JavaScript, which is executed in the browsers of users viewing the help documentation. The exploitation can be initiated remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected help documentation.