Description

A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemall-vue/src/views/items/topic/index.vue of the component Admin Topic Handler. This manipulation causes cross site scripting. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-13T17:16:57.820Z",
  "pubdate": "2026-09-13T17:16:57.820Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the AdminTopicController.validate function of the linlinjava litemall platform, specifically impacting versions 1.5.0, 1.6.0, 1.7.0, and 1.8.0.\nThe vulnerability resides in the administrative interface and allows remote attackers to inject malicious scripts into the application.\nSuccessful exploitation enables an attacker to execute arbitrary JavaScript within the context of an administrator's browser session.\nThis compromise can lead to full account takeover, unauthorized administrative actions, sensitive data exfiltration, or the redirection of users to malicious domains.\nThe vulnerability is classified as high-risk due to the potential for privilege escalation within the management console.\nExploitation is initiated remotely, and there are currently no patches available from the vendor, placing systems at continued risk of exploitation.",
  "technicalDetails": "The vulnerability is located within the AdminTopicController.validate function, situated in litemall-vue/src/views/items/topic/index.vue. The flaw stems from insufficient input sanitization and improper output encoding when handling user-supplied data within the Admin Topic Handler component.\nIn the affected versions (1.5.0 through 1.8.0), the application fails to adequately sanitize input strings before rendering them in the administrative dashboard. When a user provides malicious JavaScript payloads via the topic interface, the application stores this input in the backend database. Upon accessing the affected administrative view, the stored payload is reflected in the DOM without proper escaping.\nThe attack flow follows a typical Stored XSS pattern. First, the attacker identifies a form field within the Admin Topic Handler that interacts with the vulnerable controller. The attacker then submits a specially crafted payload, such as '<script>alert(document.cookie)</script>', which is processed by the AdminTopicController.validate function and subsequently saved to the server-side database.\nWhen an administrator or authorized user navigates to the management page responsible for displaying topic details, the vulnerable Vue.js component renders the stored payload directly into the HTML document. This execution occurs within the security context of the logged-in user’s session. Because the script executes in the user's browser, the attacker can bypass Same-Origin Policy (SOP) restrictions related to the domain of the Litemall instance.\nPost-exploitation, the attacker can leverage the executed JavaScript to capture session tokens, CSRF tokens, or perform unauthorized API requests on behalf of the victim. This effectively allows for lateral movement within the administrative panel or the extraction of sensitive business data. The flaw is persistent, meaning the malicious payload will trigger every time a victim views the affected topic management page, ensuring long-term impact until the record is manually removed from the database or the code is patched to enforce strict context-aware output encoding."
}