关键信息 漏洞信息 漏洞编号: CVE-2024-40492 漏洞类型: Stored Cross-Site Scripting (XSS) 描述 Stored XSS is a type of security vulnerability where an attacker injects malicious scripts into a web application, which are stored on the server and executed in other users' browsers when they access the stored data. 复现步骤 1. Go to 2. Create an account with: - First name: - Last name: 3. Go to "Threads" and search for the first name -> XSS is triggered -> leads to Account Take Over. 证明概念（POC） Link POC to reproduce the exploit 影响 Triggering the XSS can lead to Account Take Over. Any user viewing the user section or searching for will have their session stolen. 缓解措施 Input Validation: Validate and sanitize all user inputs on the server-side. Output Encoding: Encode data before display to prevent injected scripts. Security Libraries: Use libraries and frameworks for automatic input sanitization and output encoding. Content Security Policy (CSP): Implement CSP headers to restrict script loading sources.