Description
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dataease | SQLBot | ≤ 1.10.0 | — |
References
- Researcher Disclosure technical-description exploit issue-tracking
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/sqlbot-sqtext-dashboard-component-stored-xss-via-v-html third-party-advisory