Description

Evil users can attack other users or administrator users through this vulnerability, causing other users/administrator user accounts to be taken over

Proof of Concept

step1. Add a normal user and log in

step2. Add a new question and insert xss payload in the body

<img src=x onerror=alert(localStorage.getItem('_a_lui_')) />

Step3. Login admin user , then Click Contents --> Questtions , Click the new question submitted by the evil user Then click Edit to trigger the xss vulnerability and obtain the admin's access_ token

Impact

Executing JavaScript in victim's session which leads to potential account takeover, perform actions as that user, ...