DOM-Based Cross-Site Scripting in SSCMS v7.4.0 Error Pages via the `message` Query Parameter

[360AlphaLab]

Summary:

The current SSCMS version v7.4.0 contains a real and exploitable DOM-based Cross-Site Scripting vulnerability in its error pages. Frontend code reads attacker-controlled input from the message query parameter and renders it directly into the page through Vue’s v-html without sanitization or output encoding, allowing arbitrary JavaScript execution in the victim’s browser.

Details:

The issue involves the following files:

• src/SSCMS.Web/wwwroot/sitefiles/assets/js/utils.js
• src/SSCMS.Web/wwwroot/sitefiles/assets/js/home/error.js
• src/SSCMS.Web/wwwroot/sitefiles/assets/js/admin/error.js
• src/SSCMS.Web/Pages/home/error.cshtml
• src/SSCMS.Web/Pages/ss-admin/error.cshtml

In utils.js, the getQueryString() function directly returns decodeURIComponent of the query parameter value without any HTML encoding or sanitization. The home/error.js and admin/error.js scripts then assign the message parameter directly into the Vue data model. Finally, home/error.cshtml and ss-admin/error.cshtml render that value using v-html="message". Because v-html interprets the value as HTML, an attacker can supply a malicious payload in the message parameter and achieve script execution in the client browser.

Impact:

An attacker can trick a victim into opening a crafted URL and execute arbitrary JavaScript in the victim’s browser context. This may lead to:

• theft of accessible page data
• session hijacking
• execution of actions on behalf of the victim
• further compromise of administrative users

The /home/error/ page can be used as an unauthenticated attack surface. The /ss-admin/error/ page contains the same vulnerable sink and becomes higher impact if an administrator visits a malicious link.

Reproduction steps:

1. Visit the following URL:
   /home/error/?message=%3Cimg%20src=x%20onerror=alert(1)%3E
2. The page reads the message value from the URL query string.
3. The frontend script assigns this value into the Vue data object.
4. The error page renders the value using v-html.
5. The injected JavaScript executes in the browser and triggers alert(1), confirming the vulnerability.