Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mogu blog has a vulnerability to upload arbitrary files #65

Closed
UUFR opened this issue May 8, 2022 · 2 comments
Closed

Mogu blog has a vulnerability to upload arbitrary files #65

UUFR opened this issue May 8, 2022 · 2 comments
Assignees
Labels
bug Something isn't working

Comments

@UUFR
Copy link

UUFR commented May 8, 2022

Using mogu2021:mogu2021 to log in the Mogu blog.
http://demoweb.moguit.cn/
1 0
1 1
Choose User Center > User Avatar > Image
1 2
2
At this point, use the burp suite to capture the request packet.
Use the Repeater module in BurpSuite.
Try to change the file contents in the request package to the XSS payload and try to change the file name to the HTML suffix.
You can see the successful upload and the file path in the response package.
3
Open your browser to access the HTML file you just uploaded
4

@moxi624
Copy link
Owner

moxi624 commented Jun 5, 2022

I'm really sorry that I just noticed this issue recently. There may still be a problem with the background interface of uploading avatar. The format uploaded by users is not strictly verified, and only the front-end is used for processing.
I will fix this problem recently. Thank you again for your kind feedback

@moxi624
Copy link
Owner

moxi624 commented Jun 5, 2022

Checking the file format on the back end should solve the problem you mentioned: 2d9eb94

@moxi624 moxi624 self-assigned this Jun 5, 2022
@moxi624 moxi624 closed this as completed Jun 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants