Walks

网络安全爱好者

代码审计:phpmywind 5.3存储型XSS

前言:

一个XSS漏洞,挺有趣的,有一个以前都没发现的知识点,所以特此记录下来。


漏洞分析:

漏洞点是后台审批留言的时候产生的。

我们先看下前台对留言的处理

《代码审计:phpmywind 5.3存储型XSS》

htmlspecialchars处理,然后存储数据库

《代码审计:phpmywind 5.3存储型XSS》

后台留言查看时无弹框,点击修改后

《代码审计:phpmywind 5.3存储型XSS》

弹框出。我们看下代码

《代码审计:phpmywind 5.3存储型XSS》

这是前台代码。

《代码审计:phpmywind 5.3存储型XSS》

这是后台代码。我们看下输出,都是直接读取然后输出。那么问题来了,为什么我们在后台修改的时候会弹框呢?

百思不得其解。经过一番查找,原来问题出在KingEditor上面,KingEditor编辑器的value后的hmtl会自动解码。因此产生了这个XSS

you marke 了么?

留个Payload:

"><img/src=x onerror=alert(2001)><"

点赞
  1. lebron 10说道:

    I'm writing to make you know of the excellent encounter my friend's daughter found browsing your web site. She realized some details, which included how it is like to possess a great teaching heart to get folks without difficulty know certain complicated issues. You undoubtedly surpassed visitors' expectations. I appreciate you for showing the informative, dependable, explanatory and in addition unique thoughts on the topic to Julie.

  2. reebok outlet说道:

    I simply needed to say thanks once more. I'm not certain the things I could possibly have created in the absence of the methods provided by you about such a subject matter. It previously was a very horrifying condition in my view, nevertheless looking at a new professional mode you resolved it made me to weep for gladness. I am just happy for this information and then expect you comprehend what a powerful job you were getting into educating people with the aid of your site. More than likely you've never got to know all of us.

  3. Thanks so much for giving everyone remarkably wonderful chance to check tips from this web site. It's always so amazing and as well , packed with a great time for me and my office mates to visit the blog not less than 3 times per week to read the new stuff you will have. And definitely, I am also actually pleased for the striking information served by you. Certain two facts in this posting are definitely the most suitable we have all had.

  4. supreme hoodie说道:

    I intended to draft you one little remark in order to say thanks a lot yet again relating to the amazing things you have documented in this article. This has been simply pretty open-handed of you to deliver freely all most people could have distributed as an electronic book to get some money on their own, principally seeing that you could possibly have tried it in the event you considered necessary. These advice additionally acted to become a great way to be certain that other people online have the identical zeal like my very own to understand significantly more on the topic of this matter. Certainly there are some more pleasurable periods up front for those who examine your website.

  5. I enjoy you because of all of your hard work on this blog. Debby take interest in engaging in research and it's really easy to understand why. We hear all regarding the dynamic method you create rewarding guidance on your website and therefore boost contribution from other people on that concept while our princess is undoubtedly studying a lot of things. Enjoy the rest of the year. You're the one doing a splendid job.

  6. kobe sneakers说道:

    My wife and i got so satisfied Jordan could carry out his analysis through the precious recommendations he got through the weblog. It is now and again perplexing to simply find yourself giving out solutions that many other folks have been making money from. So we remember we have the blog owner to give thanks to for this. All of the explanations you made, the straightforward web site navigation, the friendships your site help create - it is all exceptional, and it's really aiding our son and us imagine that the topic is enjoyable, which is certainly especially vital. Thank you for all!

  7. I wanted to send you a very little word to finally give thanks as before for the spectacular tactics you've shown in this article. This is really strangely open-handed with you to allow without restraint what exactly a few people would have distributed for an e book to help make some bucks for themselves, particularly seeing that you could possibly have tried it in case you decided. Those secrets also worked to become a good way to fully grasp most people have similar fervor the same as my very own to understand lots more in terms of this issue. I am certain there are thousands of more pleasurable sessions ahead for individuals that looked over your website.

  8. goyard bags说道:

    I in addition to my buddies were found to be taking note of the excellent tactics on your web site and immediately got a horrible feeling I had not expressed respect to the website owner for those strategies. These men were definitely for that reason excited to study all of them and have very much been enjoying them. Thanks for actually being really accommodating and then for deciding on some wonderful tips millions of individuals are really needing to understand about. My personal sincere apologies for not saying thanks to you sooner.

  9. I in addition to my buddies were examining the good information on the website and so at once I had a terrible feeling I never thanked the web blog owner for those strategies. These young men came for this reason thrilled to study them and now have without a doubt been tapping into those things. Appreciation for actually being simply kind as well as for making a choice on variety of excellent guides most people are really wanting to understand about. Our honest apologies for not expressing appreciation to earlier.

  10. I have to show my thanks to this writer just for rescuing me from this type of scenario. After surfing around through the the web and meeting recommendations that were not beneficial, I assumed my entire life was over. Living devoid of the answers to the issues you have solved all through the short article is a crucial case, and the ones which may have negatively damaged my entire career if I had not noticed your website. Your primary know-how and kindness in maneuvering a lot of stuff was excellent. I don't know what I would have done if I had not discovered such a stuff like this. I am able to now look ahead to my future. Thanks for your time so much for the skilled and effective guide. I will not think twice to suggest your site to anyone who should receive guidance about this subject.

  11. air yeezy说道:

    I intended to draft you a very small observation in order to thank you so much as before with the amazing principles you have shown on this site. It's really pretty open-handed of you to make easily all that a few people could have made available for an e book to generate some money for themselves, chiefly now that you could have tried it if you ever desired. These good tips as well worked as a good way to fully grasp someone else have similar zeal like my personal own to figure out great deal more when it comes to this matter. I am certain there are some more enjoyable sessions ahead for many who browse through your blog.

  12. adidas outlet说道:

    I want to point out my admiration for your generosity in support of those people that require help with the area of interest. Your personal dedication to getting the message around appears to be certainly useful and has truly permitted people just like me to reach their dreams. The helpful publication implies a lot to me and far more to my peers. Many thanks; from each one of us.

  13. yeezy boost 350说道:

    My wife and i were absolutely more than happy that Louis could round up his inquiry through the precious recommendations he acquired out of your web site. It is now and again perplexing to simply be offering tactics which usually men and women have been trying to sell. We fully grasp we've got the website owner to appreciate because of that. These illustrations you have made, the straightforward website navigation, the relationships you will assist to create - it's got mostly great, and it's leading our son in addition to our family imagine that the theme is pleasurable, and that is exceedingly mandatory. Thanks for everything!

  14. air jordan 12说道:

    I simply wished to thank you so much all over again. I am not sure what I could possibly have carried out without those points discussed by you directly on that problem. It previously was a real horrifying scenario for me personally, but discovering a new skilled fashion you treated it made me to leap over contentment. Extremely thankful for this information and sincerely hope you find out what a powerful job you happen to be providing educating the rest through a site. I am certain you have never encountered any of us.

  15. offwhite说道:

    My spouse and i have been absolutely excited when Edward could carry out his studies from the ideas he made from your web site. It is now and again perplexing just to choose to be offering guides which usually some people could have been selling. And we all see we have got you to appreciate for this. The specific illustrations you have made, the straightforward website menu, the friendships you make it easier to promote - it's got mostly great, and it's really making our son in addition to us reason why that content is enjoyable, and that is pretty pressing. Thanks for all!

  16. nike shoes说道:

    My husband and i were very thankful Louis managed to round up his investigation through the entire precious recommendations he acquired out of your web page. It is now and again perplexing just to be giving away procedures which often many others might have been selling. So we understand we need you to be grateful to for that. Most of the illustrations you've made, the straightforward web site menu, the relationships you can make it possible to promote - it's mostly superb, and it's aiding our son and us consider that that subject matter is brilliant, which is certainly extremely essential. Many thanks for the whole lot!

  17. Thank you so much for giving everyone such a breathtaking possiblity to read articles and blog posts from this web site. It is often very superb and jam-packed with fun for me personally and my office peers to visit your blog minimum three times in a week to see the fresh things you will have. And lastly, I am also certainly satisfied concerning the terrific creative ideas served by you. Selected two tips in this posting are in truth the most impressive we have all had.

  18. golden goose说道:

    I simply needed to thank you very much again. I'm not certain what I could possibly have gone through without the entire methods contributed by you over such area of interest. It became a horrifying scenario for me, however , coming across your specialized avenue you dealt with the issue made me to weep with delight. I am just happy for this service and thus hope that you really know what an amazing job you are always putting in educating people using a web site. I know that you've never met all of us.

  19. kd shoes说道:

    I really wanted to develop a simple message in order to appreciate you for all the fabulous information you are posting at this website. My time intensive internet research has at the end been honored with good quality facts to exchange with my pals. I 'd repeat that we website visitors are unequivocally lucky to exist in a fabulous community with many special people with useful things. I feel pretty happy to have come across your entire webpages and look forward to many more amazing moments reading here. Thank you again for all the details.

  20. yeezy说道:

    I enjoy you because of all of your hard work on this site. Debby delights in going through internet research and it's really obvious why. We all learn all about the compelling medium you render advantageous thoughts by means of your web site and as well improve participation from the others on that matter then our own child is certainly discovering so much. Enjoy the rest of the year. You are always doing a glorious job.

  21. nike huarache说道:

    Thanks so much for providing individuals with remarkably memorable chance to read from here. It's usually so terrific plus stuffed with a lot of fun for me and my office mates to search the blog really three times per week to study the newest guidance you have got. Of course, I'm at all times fascinated with the incredible creative ideas you give. Selected 1 tips in this article are rather the most impressive we've ever had.

  22. golden goose说道:

    I just wanted to jot down a quick comment to express gratitude to you for the pleasant facts you are showing on this website. My long internet research has at the end been paid with awesome points to exchange with my family and friends. I 'd point out that most of us website visitors actually are very much endowed to be in a superb website with very many awesome people with useful secrets. I feel extremely grateful to have encountered the weblog and look forward to plenty of more excellent times reading here. Thank you again for everything.

  23. yeezy boost 350说道:

    Thank you a lot for giving everyone remarkably terrific chance to read in detail from this site. It is often very sweet and as well , stuffed with fun for me and my office friends to search your website a minimum of 3 times in one week to read through the new issues you will have. And lastly, we are usually amazed with the amazing concepts you give. Selected 1 ideas on this page are in fact the most efficient we have all had.

  24. moncler jackets说道:

    I needed to post you the little bit of observation to help thank you very much as before about the exceptional information you have discussed at this time. It was certainly particularly generous with you to supply without restraint all many people might have offered for sale for an e book in making some dough for themselves, chiefly considering the fact that you could possibly have tried it if you decided. Those good ideas likewise served like the easy way to recognize that some people have a similar dreams really like my very own to know way more on the topic of this condition. I know there are several more enjoyable opportunities in the future for individuals who take a look at your site.

  25. I have to show thanks to you just for rescuing me from such a setting. As a result of exploring throughout the internet and finding ways that were not beneficial, I thought my entire life was gone. Living devoid of the strategies to the issues you've solved as a result of your entire report is a critical case, and the kind that might have in a wrong way affected my career if I hadn't come across your web site. That competence and kindness in controlling the whole lot was invaluable. I am not sure what I would have done if I hadn't encountered such a solution like this. I can also at this point look ahead to my future. Thanks for your time very much for the impressive and sensible guide. I won't be reluctant to suggest your web site to any individual who desires care about this subject.

  26. yeezy boost说道:

    I must express my appreciation to the writer just for bailing me out of this type of trouble. Right after surfing around through the the net and finding views which are not pleasant, I was thinking my entire life was done. Living without the approaches to the difficulties you've fixed all through this article content is a critical case, as well as ones which might have in a wrong way damaged my career if I hadn't noticed your web site. Your own personal natural talent and kindness in playing with every part was vital. I am not sure what I would've done if I had not come upon such a thing like this. I can at this point relish my future. Thanks for your time very much for the reliable and effective guide. I won't be reluctant to endorse the website to any person who should have guidance about this subject.

  27. My spouse and i were quite cheerful Jordan managed to finish up his basic research by way of the precious recommendations he grabbed through your web pages. It is now and again perplexing to simply continually be giving freely instructions which often some people might have been selling. And now we know we have the blog owner to appreciate for this. These illustrations you've made, the easy website navigation, the relationships you can give support to create - it's got mostly remarkable, and it's facilitating our son in addition to us consider that that issue is cool, and that's tremendously fundamental. Thank you for the whole lot!

  28. I would like to show some thanks to you for bailing me out of this type of matter. As a result of surfing through the world wide web and coming across concepts which are not productive, I figured my life was well over. Being alive devoid of the solutions to the issues you have fixed all through the guide is a crucial case, as well as the kind that might have negatively damaged my entire career if I hadn't noticed your blog post. Your own understanding and kindness in handling every aspect was important. I am not sure what I would have done if I had not come upon such a thing like this. I am able to now look forward to my future. Thanks for your time very much for this skilled and amazing help. I won't think twice to recommend the sites to any person who needs and wants guidance about this subject matter.

  29. moncler outlet说道:

    I and also my friends have already been digesting the great recommendations from the website and all of a sudden developed a horrible suspicion I never thanked you for those strategies. Most of the women were consequently joyful to study all of them and now have in fact been enjoying those things. Thank you for turning out to be very thoughtful and for getting this kind of impressive subject areas millions of individuals are really wanting to discover. Our honest regret for not saying thanks to sooner.

  30. birkin bag说道:

    I needed to put you the little note in order to say thanks the moment again considering the extraordinary techniques you have shared in this article. It has been so wonderfully open-handed with people like you to convey unhampered what many individuals would've sold for an ebook in making some bucks for their own end, specifically now that you could have tried it if you ever considered necessary. These good ideas likewise worked to be the good way to recognize that other people have the identical desire the same as my personal own to understand significantly more in terms of this matter. I am sure there are several more fun moments in the future for individuals that find out your website.

  31. adidas yeezy说道:

    Thank you so much for providing individuals with such a special opportunity to read articles and blog posts from this blog. It is often so nice and also stuffed with amusement for me personally and my office mates to visit the blog minimum 3 times per week to study the newest guides you have got. And indeed, I'm always satisfied with the mind-boggling hints you serve. Some 3 areas on this page are without a doubt the most effective we've ever had.

  32. adidas gazelle说道:

    I precisely desired to say thanks all over again. I do not know the things that I might have created without those secrets shared by you about this subject matter. It had been a real depressing scenario in my view, but discovering the expert avenue you resolved that forced me to leap for contentment. I'm just happy for the information and even have high hopes you realize what an amazing job you are accomplishing teaching the others through your web site. I'm certain you've never come across all of us.

  33. jordan 6说道:

    I simply wanted to thank you very much once again. I do not know the things that I could possibly have sorted out in the absence of those recommendations shared by you on that concern. It had become an absolute distressing dilemma in my opinion, but witnessing this professional manner you dealt with it made me to weep for contentment. I am thankful for your support and even sincerely hope you are aware of an amazing job you happen to be providing instructing the others through the use of a web site. I'm certain you have never encountered all of us.

  34. asics shoes说道:

    I simply wanted to post a quick remark in order to say thanks to you for all the splendid solutions you are sharing at this site. My particularly long internet look up has finally been rewarded with good quality facts and strategies to share with my family. I 'd declare that we visitors are undoubtedly endowed to be in a very good place with so many wonderful people with useful points. I feel very much blessed to have seen your web site and look forward to plenty of more excellent minutes reading here. Thank you again for everything.

  35. yeezy boost说道:

    I really wanted to develop a small remark in order to express gratitude to you for those precious techniques you are showing at this website. My long internet investigation has now been honored with professional details to share with my classmates and friends. I would admit that we visitors are unquestionably blessed to exist in a magnificent site with very many awesome individuals with valuable plans. I feel really lucky to have used the website page and look forward to really more thrilling times reading here. Thanks once again for a lot of things.

  36. balenciaga说道:

    I have to voice my affection for your kindness for those who need help with this one idea. Your real commitment to passing the solution along appears to be really functional and have in most cases encouraged employees much like me to attain their ambitions. Your valuable report implies much a person like me and a whole lot more to my mates. Thanks a ton; from everyone of us.

  37. My wife and i have been so comfortable that Louis managed to conclude his homework through the ideas he had out of the web pages. It is now and again perplexing to just always be giving for free strategies which usually some others might have been trying to sell. And now we understand we have you to appreciate for this. All of the illustrations you made, the simple blog navigation, the relationships your site help to promote - it's everything superb, and it's really aiding our son and us consider that that article is amusing, which is certainly pretty pressing. Thank you for everything!

  38. I'm also writing to let you be aware of of the wonderful discovery my wife's daughter experienced checking your web site. She noticed a lot of things, which include what it is like to possess a great coaching style to make folks with no trouble gain knowledge of certain tortuous subject matter. You really surpassed my expectations. Thank you for supplying those insightful, trustworthy, revealing and in addition unique tips on the topic to Kate.

  39. adidas nmd说道:

    Thanks so much for giving everyone an extraordinarily brilliant chance to read articles and blog posts from here. It's usually so great and also full of amusement for me and my office peers to search your blog minimum thrice every week to read through the fresh stuff you have got. Of course, I am just at all times impressed for the awesome information you serve. Some 4 facts in this article are completely the very best I've ever had.

  40. kobe shoes说道:

    Thanks so much for giving everyone a very nice possiblity to check tips from this web site. It is often very brilliant plus full of fun for me and my office acquaintances to search your website really three times every week to study the new issues you have got. And definitely, I am actually fascinated with the wonderful solutions you give. Certain 3 tips in this posting are in truth the most beneficial we have had.

  41. converse shoes说道:

    I and my friends have already been taking note of the excellent guidelines on your web blog and instantly I had a terrible suspicion I had not thanked the site owner for them. All of the women happened to be as a consequence glad to see them and have very much been making the most of these things. I appreciate you for simply being really thoughtful and also for considering such exceptional things millions of individuals are really eager to learn about. My personal honest apologies for not saying thanks to sooner.

  42. yeezys说道:

    I together with my guys have already been checking the great key points found on the blog and unexpectedly developed an awful suspicion I had not expressed respect to the web site owner for those tips. The women appeared to be for this reason thrilled to read through them and already have in actuality been having fun with them. Thank you for really being well accommodating and then for using this sort of excellent issues millions of individuals are really wanting to understand about. My honest apologies for not saying thanks to earlier.

  43. I intended to create you one bit of remark to finally say thanks once again with your pleasing suggestions you have featured on this site. This has been certainly wonderfully open-handed of you to give publicly precisely what many individuals would've sold as an e book to help make some bucks for their own end, most importantly considering that you might have done it if you ever wanted. The pointers additionally served to become great way to fully grasp that other individuals have the identical fervor really like my very own to figure out much more when it comes to this matter. Certainly there are numerous more pleasant opportunities ahead for people who examine your site.

  44. A lot of thanks for your entire labor on this site. Betty delights in conducting research and it's easy to understand why. I notice all concerning the powerful means you provide precious techniques by means of your web site and even boost participation from others on that content and our daughter is certainly learning a great deal. Enjoy the rest of the new year. You are performing a terrific job.

  45. yeezy boost 350说道:

    Thanks so much for providing individuals with an extremely breathtaking opportunity to read articles and blog posts from here. It's always very pleasant and as well , packed with fun for me personally and my office friends to visit your web site no less than 3 times weekly to see the latest things you will have. And of course, I'm just always pleased with the spectacular concepts you give. Certain 2 points in this posting are rather the most suitable I have ever had.

  46. yeezy boost说道:

    A lot of thanks for your own hard work on this blog. My mom really likes doing research and it's really obvious why. My partner and i notice all of the powerful manner you produce rewarding tricks on your website and as well welcome response from people on the concern while our own girl has been understanding a lot. Enjoy the rest of the new year. You're conducting a good job.

  47. My wife and i have been really delighted Edward managed to finish up his investigation through the ideas he received using your weblog. It is now and again perplexing to just possibly be giving for free tactics which usually most people could have been making money from. We really already know we've got you to thank because of that. All of the explanations you've made, the simple website menu, the relationships your site make it possible to create - it's got all extraordinary, and it's letting our son and us understand that topic is exciting, and that's extraordinarily pressing. Many thanks for the whole lot!

  48. yeezy boost 350说道:

    Needed to create you that little bit of observation to finally give many thanks again regarding the beautiful pointers you've shared here. It was really pretty open-handed with you to offer unreservedly just what some people would have marketed for an electronic book in order to make some profit for themselves, principally given that you might have done it in the event you desired. These strategies additionally served like the fantastic way to be certain that someone else have similar desire really like my own to realize great deal more on the topic of this problem. Certainly there are many more fun sessions in the future for many who go through your website.

发表评论

电子邮件地址不会被公开。 必填项已用*标注