Description
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| itwanger | paicoding | — | — |
References
- https://vul.yulun.ac.cn/20261112/paicoding/ third-party-advisory
- https://github.com/itwanger/paicoding/issues/137 issue-tracking
- https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/notify/service/impl/NotifyMsgListener.java#L274-L288 technical-description
- https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/components/notice/notify-system-item.html#L18 technical-description
- VulnCheck Advisory: paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications third-party-advisory