CyberRota Analysis
AI-GeneratedThe money-pos 1.0 application is vulnerable to a stored Cross-Site Scripting (XSS) attack due to inadequate filtering of the goodsName parameter in the order log description. This flaw allows an attacker with product creation privileges to inject malicious JavaScript, which can lead to unauthorized code execution when an administrator accesses the order logs. Organizations using this Java application should prioritize addressing this vulnerability to protect against potential exploitation and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with product creation privileges can inject a malicious JavaScript payload, causing unauthorized code execution when an administrator views the order logs.