Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MajorDoMo Reflected Cross-Site Scripting in command.php
Vulnerability Description
MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
MajorDoMo 跨站脚本漏洞
Vulnerability Description
MajorDoMo是MajorDoMo社区的一个开源DIY智能家居自动化平台。 MajorDoMo存在跨站脚本漏洞，该漏洞源于command.php中的$qry参数未经清理直接渲染到HTML页面中，攻击者可通过在qry参数中注入恶意内容来注入任意JavaScript，导致反射型跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A