Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Bitbucket Server Integration Plugin
*   Continuous Integration with Toad Edge Plugin
*   Coverage/Complexity Scatter Plot Plugin
*   Flaky Test Handler Plugin
*   instant-messaging Plugin
*   JiraTestResultReporter Plugin
*   Job and Node ownership Plugin
*   Pipeline: Phoenix AutoTest Plugin
*   Proxmox Plugin
*   Proxmox Plugin
*   Proxmox Plugin
*   RocketChat Notifier Plugin
*   SiteMonitor Plugin
*   Tests Selector Plugin

**Descriptions****Stored XSS vulnerability in Bitbucket Server Integration Plugin**

**SECURITY-2639 / CVE-2022-28133**

Bitbucket Server Integration Plugin 2.0.0 through 3.1.0 (inclusive) does not limit URL schemes for callback URLs on OAuth consumers.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.

Bitbucket Server Integration Plugin 3.2.0 limits allowed URL schemes to prevent creation of consumers with `javascript:` URL scheme.

**Missing permission checks in Bitbucket Server Integration Plugin**

**SECURITY-2640 / CVE-2022-28134**

Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.

Bitbucket Server Integration Plugin 3.2.0 requires Overall/System Read permission to view BitBucket Server consumers, and Overall/Administer permission to modify them.

**Passwords stored in plain text by instant-messaging Plugin**

**SECURITY-2161 / CVE-2022-28135**

instant-messaging Plugin provides a framework for plugins integrating Jenkins with instant messaging services.

instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on instant-messaging Plugin on the Jenkins controller.

These passwords can be viewed by users with access to the Jenkins controller file system.

instant-messaging Plugin 1.42 stores passwords for group chats encrypted once the integrating plugin’s configuration is saved again.

**CSRF vulnerability and missing permission check in JiraTestResultReporter Plugin**

**SECURITY-2236 / CVE-2022-28136 (CSRF), CVE-2022-28137 (missing permission check)**

JiraTestResultReporter Plugin 165.v817928553942 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in JiraTestResultReporter Plugin 166.v0cc6208295b5.

**CSRF vulnerability and missing permission check in RocketChat Notifier Plugin**

**SECURITY-2241 / CVE-2022-28138 (CSRF), CVE-2022-28139 (missing permission check)**

RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

RocketChat Notifier Plugin 1.5.0 requires POST requests and Overall/Administer permission for the affected form validation method.

**XXE vulnerability in Flaky Test Handler Plugin**

**SECURITY-1896 / CVE-2022-28140**

Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Flaky Test Handler Plugin 1.2.2 disables external entity resolution for its XML parser.

**Password stored in plain text by Proxmox Plugin**

**SECURITY-2079 / CVE-2022-28141**

Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global `config.xml` file on the Jenkins controller as part of its configuration.

This password can be viewed by users with access to the Jenkins controller file system.

Proxmox Plugin 0.6.0 stores the Proxmox Datacenter password encrypted once its configuration is saved again.

**SSL/TLS certificate validation globally disabled by Proxmox Plugin**

**SECURITY-2081 / CVE-2022-28142**

Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation for the entire Jenkins controller JVM when configured to ignore SSL/TLS issues.

Proxmox Plugin 0.7.0 no longer disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

**CSRF vulnerability and missing permission checks in Proxmox Plugin**

**SECURITY-2082 / CVE-2022-28143 (CSRF), CVE-2022-28144 (missing permission check)**

Proxmox Plugin 0.7.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to:

*   connect to an attacker-specified host using attacker-specified username and password, performing a connection test,
    
*   disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see SECURITY-2081 / CVE-2022-28142),
    
*   and test a rollback with attacker-specified parameters.
    

Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Proxmox Plugin 0.7.1 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.

**XSS vulnerability in Continuous Integration with Toad Edge Plugin**

**SECURITY-1892 / CVE-2022-28145**

Continuous Integration with Toad Edge Plugin 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and `userContent/` from Jenkins core (`DirectoryBrowserSupport`) to serve reports.

This fork removes the `Content-Security-Policy` header functionality introduced for SECURITY-95.

This results in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control report contents.

Continuous Integration with Toad Edge Plugin 2.4 uses the built-in Jenkins file browser to serve reports.

Note

Some reports generated by this plugin rely on the ability to execute JavaScript. See the plugin’s documentation for a detailed explanation and options.

**Arbitrary file read vulnerability in Continuous Integration with Toad Edge Plugin**

**SECURITY-2633 / CVE-2022-28146**

Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps.

Continuous Integration with Toad Edge Plugin 2.4 only allows copying files from the node the build is executing on.

**Missing permission check in Continuous Integration with Toad Edge Plugin**

**SECURITY-2635 / CVE-2022-28147**

Continuous Integration with Toad Edge Plugin 2.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Continuous Integration with Toad Edge Plugin 2.4 requires Overall/Administer permission for the affected form validation method.

**Path traversal vulnerability on Windows in Continuous Integration with Toad Edge Plugin**

**SECURITY-2654 / CVE-2022-28148**

Continuous Integration with Toad Edge Plugin 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and `userContent/` from Jenkins core (`DirectoryBrowserSupport`) to serve reports.

The fork did not receive the fix for SECURITY-2481 in Jenkins 2.315 and LTS 2.303.2.

This results in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows controllers.

Continuous Integration with Toad Edge Plugin 2.4 uses the built-in Jenkins file browser to serve reports, inheriting the fix in Jenkins core if running on a recent enough version.

**Stored XSS vulnerability in Job and Node ownership Plugin**

**SECURITY-2285 / CVE-2022-28149**

Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of secondary owners.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission check in Job and Node ownership Plugin**

**SECURITY-2062 (1) / CVE-2022-28150 (CSRF), CVE-2022-28151 (missing permission check)**

Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints.

This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Note

This CSRF vulnerability is only exploitable in Jenkins 2.286 and earlier, LTS 2.277.1 and earlier. See the LTS upgrade guide.

As of publication of this advisory, there is no fix.

**CSRF vulnerability in Job and Node ownership Plugin**

**SECURITY-2062 (2) / CVE-2022-28152**

Job and Node ownership Plugin 0.13.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to restore the default ownership of a job.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in SiteMonitor Plugin**

**SECURITY-1932 / CVE-2022-28153**

SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.

**XXE vulnerability in Coverage/Complexity Scatter Plot Plugin**

**SECURITY-1899 / CVE-2022-28154**

Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the 'Public Coverage / Complexity Scatter Plot' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.

**XXE vulnerability in Pipeline: Phoenix AutoTest Plugin**

**SECURITY-1897 / CVE-2022-28155**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the `readXml` or `writeXml` build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.

**Path traversal vulnerability in Pipeline: Phoenix AutoTest Plugin allows reading arbitrary files**

**SECURITY-2683 / CVE-2022-28156**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier implements a Pipeline step (`copy`) to copy files from the running build’s directory on the Jenkins controller to an agent without sanitizing the path specified.

This allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.

As of publication of this advisory, there is no fix.

**Arbitrary file read vulnerability in Pipeline: Phoenix AutoTest Plugin**

**SECURITY-2684 / CVE-2022-28157**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier implements a Pipeline step (`ftp`) to upload files to an FTP server without limiting the source directory.

This allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.

As of publication of this advisory, there is no fix.

**Missing permission checks in Pipeline: Phoenix AutoTest Plugin allow enumerating credentials IDs**

**SECURITY-2685 / CVE-2022-28158**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in Tests Selector Plugin**

**SECURITY-2262 / CVE-2022-28159**

Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.

**Arbitrary file read vulnerability in Tests Selector Plugin**

**SECURITY-2338 / CVE-2022-28160**

Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller using the Choosing Tests parameter.

As of publication of this advisory, there is no fix.

**Severity**

*   SECURITY-1892: High
*   SECURITY-1896: High
*   SECURITY-1897: High
*   SECURITY-1899: High
*   SECURITY-1932: High
*   SECURITY-2062 (1): Medium
*   SECURITY-2062 (2): Medium
*   SECURITY-2079: Low
*   SECURITY-2081: Medium
*   SECURITY-2082: Medium
*   SECURITY-2161: Low
*   SECURITY-2236: Medium
*   SECURITY-2241: Medium
*   SECURITY-2262: High
*   SECURITY-2285: High
*   SECURITY-2338: Medium
*   SECURITY-2633: Medium
*   SECURITY-2635: Medium
*   SECURITY-2639: High
*   SECURITY-2640: Medium
*   SECURITY-2654: Medium
*   SECURITY-2683: Medium
*   SECURITY-2684: Medium
*   SECURITY-2685: Medium

**Affected Versions**

*   **Bitbucket Server Integration Plugin** up to and including 3.1.0
*   **Continuous Integration with Toad Edge Plugin** up to and including 2.3
*   **Coverage/Complexity Scatter Plot Plugin** up to and including 1.1.1
*   **Flaky Test Handler Plugin** up to and including 1.2.1
*   **instant-messaging Plugin** up to and including 1.41
*   **JiraTestResultReporter Plugin** up to and including 165.v817928553942
*   **Job and Node ownership Plugin** up to and including 0.13.0
*   **Pipeline: Phoenix AutoTest Plugin** up to and including 1.3
*   **Proxmox Plugin** up to and including 0.5.0
*   **Proxmox Plugin** up to and including 0.6.0
*   **Proxmox Plugin** up to and including 0.7.0
*   **RocketChat Notifier Plugin** up to and including 1.4.10
*   **SiteMonitor Plugin** up to and including 0.6
*   **Tests Selector Plugin** up to and including 1.3.3

**Fix**

*   **Bitbucket Server Integration Plugin** should be updated to version 3.2.0
*   **Continuous Integration with Toad Edge Plugin** should be updated to version 2.4
*   **Flaky Test Handler Plugin** should be updated to version 1.2.2
*   **instant-messaging Plugin** should be updated to version 1.42
*   **JiraTestResultReporter Plugin** should be updated to version 166.v0cc6208295b5
*   **Proxmox Plugin** should be updated to version 0.6.0
*   **Proxmox Plugin** should be updated to version 0.7.0
*   **Proxmox Plugin** should be updated to version 0.7.1
*   **RocketChat Notifier Plugin** should be updated to version 1.5.0

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Coverage/Complexity Scatter Plot Plugin
*   Job and Node ownership Plugin
*   Pipeline: Phoenix AutoTest Plugin
*   SiteMonitor Plugin
*   Tests Selector Plugin

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-1892, SECURITY-2062 (1), SECURITY-2062 (2), SECURITY-2081, SECURITY-2082, SECURITY-2683, SECURITY-2684, SECURITY-2685
*   **Daniel Beck, CloudBees, Inc. and, independently, Long Nguyen, Viettel Cyber Security, and Marc Heyries** for SECURITY-2079
*   **Jeff Thompson, CloudBees, Inc.** for SECURITY-1896, SECURITY-1897, SECURITY-1899
*   **Justin Philip** for SECURITY-2338
*   **Kevin Guerroudj** for SECURITY-2236, SECURITY-2262, SECURITY-2285
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2633, SECURITY-2635, SECURITY-2639, SECURITY-2640
*   **Marc Heyries** for SECURITY-2241
*   **Son Nguyen (@s0nnguy3n\_)** for SECURITY-2161
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1932

CVE-2022-28134: Jenkins Security Advisory 2022-03-29

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

CVE-2022-28135: Jenkins Security Advisory 2022-03-29

A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

CVE-2022-28136: Jenkins Security Advisory 2022-03-29

Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-28140: Jenkins Security Advisory 2022-03-29

A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.

CVE-2022-28138: Jenkins Security Advisory 2022-03-29

A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent.

\[Suggested description\]  
Cross SIte Scripting (XSS) vulnerability exists in pear-admin-think <=5.0.6.  
Login account to access arbitrary functions and cause stored xss through fake User-Agent

    GET /admin.php/admin.photo/index HTTP/1.1
    Host: pear.com
    Upgrade-Insecure-Requests: 1
    User-Agent: <script>alert('xss')</script>
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://pear.com/admin.php
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9,ar;q=0.8,en;q=0.7
    Cookie: PHPSESSID=23c79928dabeae8f8bf5f314b506af17; thinkphp_show_page_trace=0|0; token=JLlWdnblQBd0Ol7lKSe2w25Dj0jjoAQq31642737531.5216
    Connection: close
    
    

\[Vulnerability details\]  
first, prepare two test accounts with different levels.  
Senior administrator admin  
![图片](https://user-images.githubusercontent.com/66862331/150464191-7f0c73ca-13d3-42d7-9cf3-265a1f4f3191.png)

Click on any function such as image management and Interception of request packets , Modify UA to xss payload and forward it  
![图片](https://user-images.githubusercontent.com/66862331/150464656-6d9b69c1-4213-4e1d-9f84-76c5cafa2373.png)

CVE-2022-23903: There is a stored xss vulnerability exists in pear-admin-think <=5.0.6 · Issue #1 · pearadmin/pear-admin-think

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.

@@ -1,3 +1,6 @@ \------------------------------------------------------------------------ English \------------------------------------------------------------------------ Shopizer (for java 1.8 +) \-------------------  
@@ -119,4 +122,259 @@ If you have interest in giving feedback or for participating to Shopizer project Feel to use the contact form <http://www.shopizer.com/contact.html> and share your email address so we can send an invite to our Slack channel  
### How to Contribute: \------------------- Fork the repository to your GitHub account  
Clone from fork repository \-------------------  
$ git clone https://github.com/yourusername/shopizer.git  
Build application according to steps provided above  
Synchronize lastest version with the upstream \-------------------  
$ git remote add upstream https://github.com/yourusername/shopizer.git $ git pull upstream 2.17.0  
Create new branch in your repository \-------------------  
$ git checkout -b branch-name  
  
Check your branch status before commit to the branch \-------------------  
$ git status $ git commit  
Push changes to GitHub \-------------------  
$ git push -u origin HEAD  
  
  
\------------------------------------------------------------------------ FRENCH \------------------------------------------------------------------------  
Shopizer (pour java 1.8 +) \-------------------  
\[!\[last\_version\](https://img.shields.io/badge/last\_version-v2.12.0-blue.svg?style=flat)\](https://github.com/shopizer-ecommerce/shopizer/tree/2.12.0) \[!\[Official site\](https://img.shields.io/website-up-down-green-red/https/shields.io.svg?label=official%20site)\](http://www.shopizer.com/) \[!\[Docker Pulls\](https://img.shields.io/docker/pulls/shopizerecomm/shopizer.svg)\](https://hub.docker.com/r/shopizerecomm/shopizer) \[!\[stackoverflow\](https://img.shields.io/badge/shopizer-stackoverflow-orange.svg?style=flat)\](http://stackoverflow.com/questions/tagged/shopizer)  
  
Logiciel de commerce électronique open source Java  
\- Panier \- Catalogue \- Chercher \- Check-out \- Administration \- API REST  
Voir la démo (jsp): \------------------- http://aws-demo.shopizer.com:8080/  
Voir la démo (angular): \------------------- Bientôt disponible  
  
Obtenez le code: \------------------- Clonez le référentiel:  
$ git clone git://github.com/shopizer-ecommerce/shopizer.git  
Si c'est la première fois que vous utilisez Github, consultez http://help.github.com to learn the basics.  
Vous pouvez également télécharger le fichier zip contenant le code depuis https://github.com/shopizer-ecommerce/shopizer  
Pour créer l'application: \------------------- Depuis la ligne de commande:  
$ cd shopizer $ mvnw clean install  
  
Exécutez l'application depuis Tomcat \------------------- copier sm-shop / target / ROOT.war vers tomcat ou tout autre répertoire de déploiement du serveur d'applications  
Augmenter l'espace du tas à 1024 m （Heap space)  
### Configuration de l'espace de tas dans Tomcat (Heap space):  
  
Si vous utilisez Tomcat, modifiez catalina.bat pour les utilisateurs Windows ou catalina.sh pour les utilisateurs Linux / Mac  
sous Windows set JAVA\_OPTS="-Xms1024m -Xmx1024m -XX:MaxPermSize=256m"  
sous Linux / Mac export JAVA\_OPTS="-Xms1024m -Xmx1024m -XX:MaxPermSize=256m"  
Exécutez l'application à partir de Spring Boot \-------------------  
$ cd sm-shop $ mvnw spring-boot:run  
Exécutez l'application à partir de Spring Boot dans eclipse \-------------------  
Faites un clic droit sur com.salesmanager.shop.application.ShopApplication  
exécuter en tant qu'application Java  
### Accédez à l'application: \-------------------  
Accédez à l'application Web déployée à l'adresse: http: //localhost:8080/  
Accédez à la section d'administration à l'adresse: http://localhost: 8080/admin  
nom d'utilisateur: admin@shopizer.com  
mot de passe: password  
Les instructions ci-dessus vous permettront d'exécuter l'application avec les paramètres et configurations par défaut. Veuillez lire les instructions pour vous connecter à MySQL, configurer un serveur de messagerie et configurer d'autres sous-systèmes  
  
### Documentation: \-------------------  
Documentation disponible sur le wiki <http://shopizer-ecommerce.github.io/shopizer/#>  
ChatOps <https://shopizer.slack.com> - Rejoignez notre chaîne Slack https://shopizer-slackin.herokuapp.com/  
Plus d'informations sont disponibles sur le site Web de Shopizer ici <http://www.shopizer.com>  
### Participation: \-------------------  
Si vous souhaitez donner votre avis ou participer de quelque manière que ce soit au projet Shopizer N'hésitez pas à utiliser le formulaire de contact <http://www.shopizer.com/contact.html> et à partager votre adresse email afin que nous puissions envoyer une invitation sur notre chaîne Slack  
  
  
\------------------------------------------------------------------------ 中文版本 \------------------------------------------------------------------------ Shopizer（适用于 java 1.8 +） \-------------------  
\[!\[最新版本\](https://img.shields.io/badge/last\_version-v2.12.0-blue.svg?style=flat)\](https://github.com/shopizer-ecommerce/shopizer/tree/2.12.0) \[!\[官方网站\](https://img.shields.io/website-up-down-green-red/https/shields.io.svg?label=official%20site)\](http://www.shopizer.com/) \[!\[Docker Pulls\](https://img.shields.io/docker/pulls/shopizerecomm/shopizer.svg)\](https://hub.docker.com/r/shopizerecomm/shopizer) \[!\[stackoverflow\](https://img.shields.io/badge/shopizer-stackoverflow-orange.svg?style=flat)\](http://stackoverflow.com/questions/tagged/shopizer)  
Java开源电子商务软件  
\- 购物车 \- 目录 \- 搜索 \- 查看 \- 行政 \- REST API  
参阅演示（jsp）： \------------------- http://aws-demo.shopizer.com:8080/  
请参阅演示（角度）： \------------------- 即将推出  
  
获取代码： \------------------- 克隆存储库：  
$ git clone git://github.com/shopizer-ecommerce/shopizer.git  
如果这是您第一次使用 Github，请查看 http://help.github.com 以了解基础知识。  
您还可以从 https://github.com/shopizer-ecommerce/shopizer 下载包含代码的 zip 文件  
将要构建应用程序：  
\------------------- 从命令行：  
$ cd shopizer $ mvnw clean install  
从 Tomcat 运行应用程序 \------------------- 将 sm-shop/target/ROOT.war 复制到 tomcat 或任何其他应用服务器部署目录  
将堆空间增加到 1024 m  
###Tomcat中的堆空间配置：  
  
如果您使用 Tomcat，请为 windows 用户编辑 catalina.bat 或为 linux / Mac 用户编辑 catalina.sh  
在 Windows 中 设置 JAVA\_OPTS="-Xms1024m -Xmx1024m -XX:MaxPermSize=256m"  
在 Linux / Mac 中 导出 JAVA\_OPTS="-Xms1024m -Xmx1024m -XX:MaxPermSize=256m"  
从 Spring Boot 运行应用程序 \-------------------  
$ cd sm-shop $ mvnw spring-boot:run  
在 Eclipse 中从 Spring Boot 运行应用程序 \-------------------  
右键单击 com.salesmanager.shop.application.ShopApplication  
作为 Java 应用程序运行  
### 访问应用程序： \-------------------  
访问已部署的 Web 应用程序：http://localhost:8080/  
访问管理部分：http://localhost:8080/admin  
用户名：admin@shopizer.com  
密码：password  
上述说明将让您使用默认设置和配置运行应用程序。 请阅读有关如何连接到 MySQL、配置电子邮件服务器和配置其他子系统的说明  
  
### 文档： \-------------------  
可从 wiki <http://shopizer-ecommerce.github.io/shopizer/#> 获得的文档  
ChatOps <https://shopizer.slack.com> - 加入我们的 Slack 频道 https://shopizer-slackin.herokuapp.com/  
更多信息可在此处的购物者网站上获得 <http://www.shopizer.com>  
### 参与： \-------------------  
如果您有兴趣提供反馈或以任何方式参与 Shopizer 项目 请使用联系表 <http://www.shopizer.com/contact.html> 并分享您的电子邮件地址 这样我们就可以邀请您进入我们的 Slack 频道

CVE-2022-23059: working version 3.0.alpha · shopizer-ecommerce/shopizer@6b9f1ec

A vulnerability was found in DolphinPHP up to 1.5.0 and classified as problematic. Affected by this issue is the User Management Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

**DolphinPHP<=1.5.0 Authenticated Stored Cross-Site Scripting(XSS)****Description**

    The system Client doesn't properly sanitise POST parameter, which result into a Stored Cross-Site Scripting(XSS).
    

**Vendor Homepage**

    https://dolphinphp.com/
    https://github.com/caiweiming/DolphinPHP
    

**Author**

    webraybtl@webray.com.cn inc  
    

**Proof of Concept**

1,After the system installation is completed, log in to the background ![blockchain](https://github.com/xiahao90/CVEproject/raw/main/imgs/20220317154815.png "DolphinPHP<=1.5.0 Authenticated Stored Cross-Site Scripting(XSS)") ![blockchain](https://github.com/xiahao90/CVEproject/raw/main/imgs/20220317154848.png "DolphinPHP<=1.5.0 Authenticated Stored Cross-Site Scripting(XSS)") ![blockchain](https://github.com/xiahao90/CVEproject/raw/main/imgs/20220317154902.png "DolphinPHP<=1.5.0 Authenticated Stored Cross-Site Scripting(XSS)")

2,Insert a danger code where the nickname is modified in the personal settings

    <script>alert(1);</script>超级管理员
    

![blockchain](https://github.com/xiahao90/CVEproject/raw/main/imgs/20220317155039.png "DolphinPHP<=1.5.0 Authenticated Stored Cross-Site Scripting(XSS)")

3,Click "user" - > "permission management" - > "user management" to execute the code ![blockchain](https://github.com/xiahao90/CVEproject/raw/main/imgs/20220317155317.png "DolphinPHP<=1.5.0 Authenticated Stored Cross-Site Scripting(XSS)") ![blockchain](https://github.com/xiahao90/CVEproject/raw/main/imgs/20220317155341.png "DolphinPHP<=1.5.0 Authenticated Stored Cross-Site Scripting(XSS)")

CVE-2022-1086: CVEproject/DolphinPHPV1.5.0_xss.md at main · xiahao90/CVEproject

DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will be attacked.

![pentest](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_pentest.png)

**In IT-Systeme eindringen – nach allen Regeln der Kunst****In IT-Systeme eindringen – nach allen Regeln der Kunst**

![rotate card](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/refresh.svg)

**Pentest****In IT-Systeme eindringen – nach allen Regeln der Kunst**

Es vergeht keine Woche, in der Hacker nicht in Netzwerke, Server und PCs eindringen. Es vergeht kein Tag, an dem wir nicht das Gleiche tun – aber in Ihrem Auftrag. Unsere Penetrationstester sind bestens mit Angriffsmethoden auf IT-Systeme vertraut.

weitere Informationen

**Technisches Consulting****Kompetent beraten - IT sichern**

Es gibt viele Gründe für Unternehmen und Organisationen, sich in Fragen der IT-Sicherheit beraten zu lassen: ein Sicherheitsvorfall, Ergebnisse eines Penetrationstests, neue Anforderungen, Outtasking von Aufgaben oder andere Hintergründe. Die SySS unterstützt Sie bereits zu Projektbeginn oder auch während des gesamten Projektverlaufs mit der entscheidenden Expertise.

weitere Informationen

![digital-forensic](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_digital-forensic.png)

**Digitale Forensik****Gefahren abwehren – Beweise sichern****Gefahren abwehren – Beweise sichern**

![rotate card](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/refresh.svg)

**Digitale Forensik****Gefahren abwehren – Beweise sichern**

Die SySS GmbH unterstützt Sie bei der Aufklärung akuter IT-Sicherheitsvorfälle und der Erfassung gerichtsverwertbarer Daten in Ihrem Unternehmensnetzwerk. Dazu gehört u.a. die Sicherung und Analyse digitaler Spuren nach einem Angriff.

weitere Informationen

![red-teaming](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_red-teaming.png)

**Red Teaming****APT geplant erleben – Abwehr trainieren****APT geplant erleben – Abwehr trainieren**

![rotate card](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/refresh.svg)

**Red Teaming****APT geplant erleben – Abwehr trainieren**

Die Bedrohung durch gezielte Angriffe auf Unternehmen und Institutionen steigt zunehmend an. Aus einer externen Perspektive ohne Vorkenntnisse simulieren wir einen solchen zielgerichteten Angriff. Dabei testen wir Ihre Prozesse und Systeme sowie das Bewusstsein Ihrer Mitarbeiter für IT-Sicherheit.

weitere Informationen

![live-hacking](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_live-hacking.png)

**Live-Hacking****Angriffe erlebbar machen – Sensibilität steigern****Angriffe erlebbar machen – Sensibilität steigern**

![rotate card](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/refresh.svg)

**Live-Hacking****Angriffe erlebbar machen – Sensibilität steigern**

Wer sich vor Angriffen aus dem Netz schützen will, sollte die Arbeitsweise von Hackern genau kennen. Im Live-Hacking führen unsere Spezialisten eindrucksvoll – und live – vor Augen, wie leicht es ist, an die Daten Dritter zu gelangen.

weitere Informationen

![schulung](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_schulung.png)

**Schulung****Sicherheit trainieren – Kompetenzen ausbauen****Sicherheit trainieren – Kompetenzen ausbauen**

![rotate card](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/refresh.svg)

**Schulung****Sicherheit trainieren – Kompetenzen ausbauen**

Sicherheitsbeauftragte Ihres Unternehmens und alle für IT zuständigen Mitarbeiter werden von SySS umfassend in aktuellen Fragen und Vorgehensweisen zur IT-Sicherheit ausgebildet. Wir lassen Sie in die Welt des Hackens eintreten.

weitere Informationen

*   ![pentest](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_pentest.png)
    
    **Pentest****In IT-Systeme eindringen – nach allen Regeln der Kunst**
    
    Es vergeht keine Woche, in der Hacker nicht in Netzwerke, Server und PCs eindringen. Es vergeht kein Tag, an dem wir nicht das Gleiche tun – aber in Ihrem Auftrag. Unsere Penetrationstester sind bestens mit Angriffsmethoden auf IT-Systeme vertraut.
    
*   ![digital-forensic](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_digital-forensic.png)
    
    **Digitale Forensik****Gefahren abwehren – Beweise sichern**
    
    Die SySS GmbH unterstützt Sie bei der Aufklärung akuter IT-Sicherheitsvorfälle und der Erfassung gerichtsverwertbarer Daten in Ihrem Unternehmensnetzwerk. Dazu gehört u.a. die Sicherung und Analyse digitaler Spuren nach einem Angriff.
    
*   ![red-teaming](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_red-teaming.png)
    
    **Red Teaming****APT geplant erleben – Abwehr trainieren**
    
    Die Bedrohung durch gezielte Angriffe auf Unternehmen und Institutionen steigt zunehmend an. Aus einer externen Perspektive ohne Vorkenntnisse simulieren wir einen solchen zielgerichteten Angriff. Dabei testen wir Ihre Prozesse und Systeme sowie das Bewusstsein Ihrer Mitarbeiter für IT-Sicherheit.
    
*   ![live-hacking](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_live-hacking.png)
    
    **Live-Hacking****Angriffe erlebbar machen – Sensibilität steigern**
    
    Wer sich vor Angriffen aus dem Netz schützen will, sollte die Arbeitsweise von Hackern genau kennen. Im Live-Hacking führen unsere Spezialisten eindrucksvoll – und live – vor Augen, wie leicht es ist, an die Daten Dritter zu gelangen.
    
*   ![schulung](https://syss.de/typo3conf/ext/user_site/Resources/Public/Images/icon_schulung.png)
    
    **Schulung****Sicherheit trainieren – Kompetenzen ausbauen**
    
    Sicherheitsbeauftragte Ihres Unternehmens und alle für IT zuständigen Mitarbeiter werden von SySS umfassend in aktuellen Fragen und Vorgehensweisen zur IT-Sicherheit ausgebildet. Wir lassen Sie in die Welt des Hackens eintreten.
    

**Aktuelles**

**Auszeichnung für die SySS**

![](https://syss.de/fileadmin/_processed_/7/b/csm_BrandEins_IT2022_Logo_untere_Seite_0c21ed3517.jpg)

brand eins zählt SySS zu den besten IT-Dienstleistern 2022!

Ihr direkter Kontakt zu SySS +49 (0)7071 - 40 78 56-0 oder anfrage@syss.de | IN DRINGENDEN FÄLLEN AUSSERHALB DER GESCHÄFTSZEITEN +49 (0)7071 - 40 78 56-99

Als Rahmenvertragskunde wählen Sie bitte die bereitgestellte Rufbereitschaftsnummer

Ihr direkter Kontakt zu SySS +49 (0)7071 - 40 78 56-0 oder anfrage@syss.de

IN DRINGENDEN FÄLLEN AUSSERHALB DER GESCHÄFTSZEITEN +49 (0)7071 - 40 78 56-99

Als Rahmenvertragskunde wählen Sie bitte die bereitgestellte Rufbereitschaftsnummer

Direkter Kontakt

+49 (0)7071 - 40 78 56-0 oder anfrage@syss.de

IN DRINGENDEN FÄLLEN AUSSERHALB DER GESCHÄFTSZEITEN

+49 (0)7071 - 40 78 56-99

Als Rahmenvertragskunde wählen Sie bitte die bereitgestellte Rufbereitschaftsnummer

CVE-2022-24957: SySS GmbH - The Pentest Experts

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in index.php.

**CVE-2021-45866****XSS-in-Student-attendance-management**

Description: Persistent Cross Site Scripting found in Student Attendance Management System from Sourcecodester website.

\[Additional Information\] NA

\[Vulnerability Type\] Cross Site Scripting (XSS)

\[Vendor of Product\] https://www.sourcecodester.com/

\[Affected Product Code Base\] Student Attendance Management System

\[Affected Component\] http://localhost/student\_attendance/index.php?page=courses

\[Attack Type\] Remote

\[Impact Information Disclosure\] true

\[Attack Vectors\] Steps to reproduce: Go to url http://localhost/student\_attendance/ Click on "Course" in the left column Enter the payload "<img(space)src=1(space)href=1(space)onerror="javascript:alert(1)">" in the "Course" field (PS: Replace (space) with regular space) Click on "Save" XSS will be triggered and pop up appears.

\[Discoverer\] M Lohith

Tag

#xss