Cross-site Scripting (XSS) - Stored in zoujingli/thinkadmin
Valid
Reported on
Sep 17th 2021
Description
Stored XSS Content allows for the arbitrary execution of JavaScript
Proof of Concept
In Wechat management at feature
- Reply rule management
- Follow reply configuration
- Default reply configuration
- Follow automatic replies
Save Reply text with payload : </titLe/</teXtarEa/</scRipt/--!>\x3csVg/<iMg SrC="x" oNeRRor="alert(1);">\x3e
XSS will trigger when reloading page or goto edit
Video PoC
Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie.
We have contacted a member of the
zoujingli/thinkadmin
team and are waiting to hear back
2 years ago
HTML needs to be parsed during mobile phone preview. Only HTML executable script filtering can be done here.
I noticed this problem happened when the textarea tags were escaped by my payload rather than the mobile phone preview
I already know the problem. Now I'm going to XSS filter the submitted data and delete the on* and script of all elements.
Execute the following command to resolve the problem:
composer update
php think xadmin:install wechat
to join this conversation