| 标题 | Zorlan skycaiji 2.8 Cross Site Scripting |
|---|
| 描述 | You can see the detailed exploit details on my blog, the password is fushuling123：https://fushuling.com/index.php/2024/06/13/test2/
In the latest version of skycaiji 2.8 (https://github.com/zorlan/skycaiji), I found an XSS vulnerability. The reason is that although the source code prohibits some possible xss tags, the target does not filter the img tag enough, which allows the attacker to bypass it through eval(String.fromCharCode()) and finally cause the xss attack.
We can construct malicious data on our own website. If the target collects data on our website, it will cause XSS to appear.
<?php
$data = array(
'xss' => '<img src=\'xss\' onerror="eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))">',
);
$json = json_encode($data);
header('Content-type: application/json');
echo $json;
When the target creates a task to collect data on a malicious web page and clicks on the preview, the malicious code will be triggered, causing XSS to occur.
Enter the webpage where we have constructed malicious data
Since the webpage constructed by the source code has a login record field, and the value of this field is fixed and will not change, if the attacker obtains the cookie through XSS and then writes it into the webshell through the previously submitted code injection function, the attacker can completely execute unauthorized commands in the foreground
My repair suggestion: Filter the collected data to prevent malicious code injection |
|---|
| 用户 | fushuling (UID 45488) |
|---|
| 提交 | 2024-06-13 06時56分 (2 年前) |
|---|
| 管理 | 2024-06-21 18時32分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 269419 [Zorlan SkyCaiji 直到 2.8 Task onerror 跨网站脚本] |
|---|
| 积分 | 20 |
|---|