DedeCMS v5.7 shops delivery 存儲型XSS漏洞

From PwnWiki
Revision as of 10:16, 10 April 2021 by Pwnwiki (talk | contribs) (Marked this version for translation)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Other languages:
Chinese • ‎English

前提條件

需要站點啟用商城功能。

漏洞利用

後台添加 配送方式:

Add delivery.png

添加成功後直接展示配送方式列表,觸發 XSS; 此外,這個 XSS 在前台用戶購買東西選擇配送方式的時候也會觸發