Description

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site scripting. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-09-13T17:16:57.987Z",
  "pubdate": "2026-09-13T17:16:57.987Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the linlinjava litemall product within the Product Detail component.\nThe vulnerability allows remote attackers to inject malicious scripts into the application, which are then executed within the context of a victim's browser session.\nAffected versions include 1.4.0, 1.5.0, 1.6.0, 1.7.0, and 1.8.0.\nThis vulnerability stems from improper input validation in the AdminGoodsService.validate function and improper handling of the 'detail' argument within the litemall-vue/src/views/items/detail/index.vue component.\nSuccessful exploitation can lead to unauthorized actions on behalf of the user, theft of session cookies, or the defacement of the application interface.\nThe vulnerability is remotely exploitable and does not require complex prerequisites, posing a significant risk to the integrity and confidentiality of the end-user's session.",
  "technicalDetails": "The vulnerability originates from the lack of robust sanitization or output encoding when processing the 'detail' argument within the litemall-vue/src/views/items/detail/index.vue component.\nIn the affected versions (1.4.0 through 1.8.0), the AdminGoodsService.validate function fails to perform adequate validation of user-supplied data before it is rendered by the frontend application.\nWhen a user or administrator provides a crafted 'detail' string containing malicious JavaScript payloads, the application stores this data in the backend database. Upon accessing the product detail view, the Vue.js frontend renders this input without proper escaping or sanitization processes, leading to the execution of the injected script in the browser of any user viewing the affected product.\nThe attack flow proceeds as follows: First, an attacker identifies a vector to inject data into the 'detail' field associated with product information. Second, the attacker submits a payload, such as '<script>alert(document.cookie)</script>' or other DOM-based XSS vectors, through an interface that interfaces with AdminGoodsService. Third, the application stores this malicious content in the backend persistent storage. Fourth, when a legitimate user or administrator navigates to the litemall-vue/src/views/items/detail/index.vue page, the application fetches the tainted 'detail' data and dynamically renders it into the DOM. Finally, the browser interprets the injected script tag as legitimate code and executes it within the security context of the origin, granting the attacker the ability to perform actions on behalf of the victim.\nThis vulnerability is categorized as a stored XSS, as the malicious payload resides within the application database and is delivered to users upon page load. Because the litemall-vue component directly processes the 'detail' object without sufficient output encoding (such as converting special characters into HTML entities), the application remains highly susceptible to script injection. The impact is significant, as it allows attackers to bypass same-origin policies, hijack administrative sessions if an admin views the item, or deploy persistent malware hooks within the user's browser environment."
}