| 标题 | Total.js CMS 10 Open Redirect |
|---|
| 描述 | Total.js Flow v10 (Flow 1.0.0, Total.js v5012) is vulnerable to Cross-Site Scripting (XSS) and Open Redirect. During page creation, the application allows content to reference files previously uploaded to the system (uploads). It was possible to upload images containing malicious payloads (SVGs with onload / <script> and HTML/meta tags for open redirect). When creating a page and referencing these images in the editor/layout, clicking the referenced image causes the file to be loaded and rendered inline by the browser, executing the stored payload. As a result, Stored XSS and Open Redirect can be triggered via user-uploaded files.
PoC:
Upload an image containing an XSS or Open Redirect payload. Then go to http://localhost:8000/admin/nav/, click Main > Create link > Browser files, and select the images with the payloads. In http://localhost:8000/admin/pages/, create the page and trigger the reference titles — this flow allows exploitation of Cross-Site Scripting (XSS) and Open Redirect vulnerabilities. |
|---|
| 来源 | ⚠️ http://localhost:8000/admin/pages/ |
|---|
| 用户 | Edcarlos (UID 53778) |
|---|
| 提交 | 2025-09-30 05時52分 (1 年前) |
|---|
| 管理 | 2025-10-12 08時30分 (12 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 328072 [Total.js Flow 直到 673ef9144dd25d4f4fd4fdfda5af27f230198924 SVG File 权限提升] |
|---|
| 积分 | 0 |
|---|