| शीर्षक | Zorlan skycaiji 2.8 Cross Site Scripting |
|---|
| विवरण | You can see the detailed exploit details on my blog, the password is fushuling123：https://fushuling.com/index.php/2024/06/13/test2/
In the latest version of skycaiji 2.8 (https://github.com/zorlan/skycaiji), I found an XSS vulnerability. The reason is that although the source code prohibits some possible xss tags, the target does not filter the img tag enough, which allows the attacker to bypass it through eval(String.fromCharCode()) and finally cause the xss attack.
We can construct malicious data on our own website. If the target collects data on our website, it will cause XSS to appear.
<?php
$data = array(
'xss' => '<img src=\'xss\' onerror="eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))">',
);
$json = json_encode($data);
header('Content-type: application/json');
echo $json;
When the target creates a task to collect data on a malicious web page and clicks on the preview, the malicious code will be triggered, causing XSS to occur.
Enter the webpage where we have constructed malicious data
Since the webpage constructed by the source code has a login record field, and the value of this field is fixed and will not change, if the attacker obtains the cookie through XSS and then writes it into the webshell through the previously submitted code injection function, the attacker can completely execute unauthorized commands in the foreground
My repair suggestion: Filter the collected data to prevent malicious code injection |
|---|
| उपयोगकर्ता | fushuling (UID 45488) |
|---|
| सबमिशन | 13/06/2024 06:56 AM (2 साल पहले) |
|---|
| संयम | 21/06/2024 06:32 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 269419 [Zorlan SkyCaiji तक 2.8 Task onerror क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|