CVE-2018-19091

Vulnerability

tianti 2.3 is affected by a reflected cross-site scripting (XSS) vulnerability in the user management module. The vulnerable endpoint is tianti-module-admin/user/list, where the userName parameter is echoed back into the response without proper sanitization or encoding [1]. This occurs in user_list.jsp which directly displays the value received from the controller, as noted in the source code review [1].

Exploitation

An attacker can craft a malicious URL containing XSS payload in the userName parameter. For example, a payload like `` can be injected [1]. The attacker then sends the link to a victim with administrative privileges; when the victim clicks the link and the user list page renders, the script executes in the browser. No authentication is required for the initial request, but the impact depends on the victim's session [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session cookie theft, enabling account takeover or privilege escalation if an admin user is targeted [1]. The vulnerability is classified as reflected XSS, though the same module also contains stored XSS vectors [1].

Mitigation

The issue was reported via a GitHub issue [1] but no official patch or fixed version has been confirmed. Users should validate and sanitize all user-supplied input before rendering in web pages, and implement Content-Security-Policy headers to reduce risk. As no fix is publicly available, upgrading to a secure version is not possible until the vendor releases a patch.