Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stored XSS #304

Open
ssssdl opened this issue Sep 4, 2019 · 0 comments
Open

Stored XSS #304

ssssdl opened this issue Sep 4, 2019 · 0 comments

Comments

@ssssdl
Copy link

ssssdl commented Sep 4, 2019

I find a Stored XSS

client user can use this vulnerability to attack administrator users,Can use js to send post request, indirectly operate the administrator account,a serious threat to website security。

exploit

client login site,and modify the account name to </span><img src=1 onerror=alert(1) /><span>
now,if super user login and look clients,Will trigger XSS。
image

Hackers can exploit this vulnerability to perform any action by the administrator

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant