जमा करें #511411: dayrui xunruicms 4.6.3 Stored Cross Site Scripting

For detailed information, please refer to: https://github.com/dayrui/xunruicms/issues/7
payload：<iframe src=&#x0006A&#x00061&#x00076&#x00061&#x00073&#x00063&#x00072&#x00069&#x00070&#x00074&#x0003A&#x00061&#x0006C&#x00065&#x00072&#x00074&#x00028&#x00031&#x00029>
is different from CVE-2024-31634，<svg> can not use here
dayrui XunruiCMS 4.6.3 is vulnerable to a stored XSS (Cross-Site Scripting) vulnerability. This vulnerability exists in the "Website Information - Friendly Links" section, where links are displayed using <a href="link">. The system can parse Unicode encoding, and by closing the tag using Unicode encoding to bypass the restrictions, a stored XSS attack can be triggered.

• स्रोत: ⚠️ https://github.com/dayrui/xunruicms/issues/7
• उपयोगकर्ता: SecHZredo (UID 81966)
• सबमिशन: 28/02/2025 05:41 AM (2 साल पहले)
• संयम: 09/03/2025 08:05 AM (9 days later)
• स्थिति: स्वीकृत
• VulDB प्रविष्टि: 299051 [dayrui XunRuiCMS तक 4.6.3 Friendly Links Website Address क्रॉस साइट स्क्रिप्टिंग]
• अंक: 20