| शीर्षक | Zorlan skycaiji 2.8 Cross Site Scripting |
|---|
| विवरण | You can see the detailed exploit details on my blog, the password is fushuling123：https://fushuling.com/index.php/2024/06/19/test3/
In the latest version of skycaiji 2.8 (https://github.com/zorlan/skycaiji), I found an XSS vulnerability. The reason is that although the source code prohibits some possible xss tags, the target does not filter the img tag enough, which allows the attacker to bypass it through eval(String.fromCharCode()) and finally cause the xss attack.
In this parsing preview function, if the website owner collects the website containing our malicious data and chooses to preview it, our malicious js code will be triggered.
<?php
$data = array(
'xss' => '<img src=\'xss\' onerror="eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))">',
);
$json = json_encode($data);
header('Content-type: application/json');
echo $json;
Select the preview function in the background and enter the URL containing our malicious code
The vulnerable URL is http://127.0.0.4/index.php?s=/admin/tool/preview |
|---|
| उपयोगकर्ता | fushuling (UID 45488) |
|---|
| सबमिशन | 19/06/2024 04:41 PM (2 साल पहले) |
|---|
| संयम | 27/06/2024 07:10 AM (8 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 269773 [skycaiji 2.8 /admin/tool/preview क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|