提出 #355783: Zorlan skycaiji 2.8 Cross Site Scripting

You can see the detailed exploit details on my blog, the password is fushuling123：https://fushuling.com/index.php/2024/06/13/test2/

In the latest version of skycaiji 2.8 (https://github.com/zorlan/skycaiji), I found an XSS vulnerability. The reason is that although the source code prohibits some possible xss tags, the target does not filter the img tag enough, which allows the attacker to bypass it through eval(String.fromCharCode()) and finally cause the xss attack.

We can construct malicious data on our own website. If the target collects data on our website, it will cause XSS to appear.

<?php

$data = array(
'xss' => '<img src=\'xss\' onerror="eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))">',
);

$json = json_encode($data);

header('Content-type: application/json');
echo $json;

When the target creates a task to collect data on a malicious web page and clicks on the preview, the malicious code will be triggered, causing XSS to occur.

Enter the webpage where we have constructed malicious data

Since the webpage constructed by the source code has a login record field, and the value of this field is fixed and will not change, if the attacker obtains the cookie through XSS and then writes it into the webshell through the previously submitted code injection function, the attacker can completely execute unauthorized commands in the foreground

My repair suggestion: Filter the collected data to prevent malicious code injection

• ユーザー: fushuling (UID 45488)
• 送信: 2024年06月13日 06:56 (2 年 ago)
• モデレーション: 2024年06月21日 18:32 (8 days later)
• ステータス: 承諾済み
• VulDBエントリ: 269419 [Zorlan SkyCaiji 迄 2.8 Task onerror クロスサイトスクリプティング]
• ポイント: 20