XSS vulnerability caused by file upload(tduck-platform4.0)

[libaibaia]

1. upload code: https://github.com/TDuckCloud/tduck-platform/blob/master/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UploadFileController.java

• Create a test form system

2. After creating the form system, upload the HTML file, you can see that the request does not contain authentication information
3. Background preview data execution script

[0yingteam]

这么快的么？我两周前也审计到了这个

[0yingteam]

从审计角度还有一个默认账号的高危漏洞