SakuraPanel icon indicating copy to clipboard operation
SakuraPanel copied to clipboard

Possible XSS vulnerability

Open enferas opened this issue 2 years ago • 4 comments

Hello,

I would like to report for XSS vulnerability.

In file https://github.com/ZeroDream-CN/SakuraPanel/blob/master/core/PostHandler.php

line 87

$result = $pm->checkRules($_POST);

In function checkRules

public function checkRules($data)
{
                // ....
		if($this->isProxyNameExist($data['proxy_name'])) {
			return Array(false, "隧� {$data['proxy_name']} 已存在,请使用其他�字");
		}
               // ....
}

line 96

$msg = $result[1] ?? "未知错误";
exit($msg);

exit will terminate the script and print the message which have the value $data['proxy_name']. Then there is XSS vulnerability

enferas avatar Nov 11 '21 16:11 enferas