Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector justified by review submission over HTTP; authentication required (PR:L); user interaction required for victim to view payload; integrity-only impact from XSS execution.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. This product adopts a rolling release strategy to maintain continuous delivery The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stored or reflected cross-site scripting in sunhailin12315/product-review allows authenticated users to inject malicious JavaScript via the content parameter in the Write a Review component, which executes in other users' browsers when they view the review. Exploitation requires valid user credentials and victim interaction with the malicious review content. Public proof-of-concept code exists, but EPSS exploitation probability remains at 0.04%, indicating minimal real-world targeting despite the attack surface.
Technical ContextAI
The product-review system implements a user review submission feature (Write a Review component) that fails to properly sanitize or escape user-supplied content before reflecting or storing it in HTML responses. This constitutes a CWE-79 input validation failure. The vulnerable parameter accepts arbitrary text, including HTML and JavaScript, which is rendered without content-type restrictions or output encoding. The network-accessible architecture allows any authenticated user to craft malicious payloads targeting other users or site visitors.
Affected ProductsAI
sunhailin12315/product-review up to commit 91ead6890b4065bb45b7602d0d73348e75cb4639. The project uses a rolling release strategy without formal version tags. No CPE assignment was identified. The vulnerable component is the Write a Review functionality, specifically the content parameter handling. Reference: Gitee issue tracker at https://gitee.com/sunhailin12315/product-review/issues/ICK775.
RemediationAI
No vendor-released patch identified at time of analysis; the project maintainer has not responded to the early notification. Immediate remediation requires input sanitization of the content parameter using an HTML encoding library (e.g., OWASP ESAPI, DOMPurify for JavaScript contexts) to neutralize script tags and event handlers before storage or output. Implement a Content Security Policy (CSP) header with script-src directive restricting inline scripts and unsafe-eval to mitigate XSS execution even if sanitization is bypassed. Apply HTML entity encoding to all user-submitted content on output. Consider web application firewall (WAF) rules blocking common XSS payloads (script tags, event handlers) in the content parameter, though this is secondary to proper encoding. Side effect of strict CSP policies may impact legitimate functionality requiring inline styles or scripts-test thoroughly in staging.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today