Walks

网络安全爱好者

代码审计:phpmywind 5.3存储型XSS

前言:

一个XSS漏洞,挺有趣的,有一个以前都没发现的知识点,所以特此记录下来。


漏洞分析:

漏洞点是后台审批留言的时候产生的。

我们先看下前台对留言的处理

《代码审计:phpmywind 5.3存储型XSS》

htmlspecialchars处理,然后存储数据库

《代码审计:phpmywind 5.3存储型XSS》

后台留言查看时无弹框,点击修改后

《代码审计:phpmywind 5.3存储型XSS》

弹框出。我们看下代码

《代码审计:phpmywind 5.3存储型XSS》

这是前台代码。

《代码审计:phpmywind 5.3存储型XSS》

这是后台代码。我们看下输出,都是直接读取然后输出。那么问题来了,为什么我们在后台修改的时候会弹框呢?

百思不得其解。经过一番查找,原来问题出在KingEditor上面,KingEditor编辑器的value后的hmtl会自动解码。因此产生了这个XSS

you marke 了么?

留个Payload:

"><img/src=x onerror=alert(2001)><"

点赞
  1. yeezy boost 350说道:

    Thank you so much for providing individuals with an extremely superb chance to read critical reviews from this site. It is often very kind and as well , stuffed with a lot of fun for me personally and my office colleagues to search the blog a minimum of thrice every week to see the new guides you have got. And of course, I am just at all times contented considering the good creative ideas served by you. Selected 1 points in this posting are truly the best we've had.

  2. golden goose说道:

    I precisely needed to appreciate you yet again. I do not know the things I would've followed without the ideas shared by you regarding this theme. It has been an absolute hard difficulty in my position, nevertheless taking note of your specialised fashion you resolved the issue took me to leap with joy. Extremely grateful for the service and in addition expect you are aware of a great job you are always putting in educating others using your webpage. I am certain you've never met any of us.

  3. air jordans说道:

    I must point out my respect for your kindness in support of persons that need help on this one concept. Your special dedication to getting the solution around ended up being exceedingly insightful and has regularly enabled somebody much like me to get to their pursuits. Your personal interesting suggestions denotes so much to me and far more to my office colleagues. Thanks a ton; from everyone of us.

  4. Thanks for all of the hard work on this site. My aunt really loves participating in research and it's obvious why. A number of us learn all regarding the powerful means you make useful items by means of your web site and as well boost participation from some others on that area of interest plus our own simple princess is understanding a lot. Have fun with the remaining portion of the new year. You are always carrying out a good job.

  5. I am also writing to make you understand of the useful experience our princess experienced checking your webblog. She noticed too many pieces, with the inclusion of how it is like to possess a marvelous teaching spirit to let other people completely comprehend certain impossible topics. You undoubtedly surpassed readers' desires. Thank you for giving those interesting, trusted, explanatory and as well as cool guidance on the topic to Sandra.

  6. I needed to put you that little bit of remark just to thank you as before considering the stunning things you've featured on this site. It was quite surprisingly open-handed with people like you in giving unhampered all some people would have offered for sale for an ebook to help with making some cash on their own, even more so seeing that you could possibly have tried it in the event you decided. Those tricks in addition acted as a easy way to understand that most people have a similar dream much like my personal own to know a little more with respect to this matter. I know there are millions of more enjoyable times ahead for those who scan your site.

  7. adidas superstar说道:

    Thanks for your entire labor on this website. My aunt really likes going through investigations and it is obvious why. Most people learn all of the powerful method you produce important secrets by means of your blog and improve participation from other people on this topic plus our favorite daughter is now understanding a great deal. Take advantage of the remaining portion of the new year. You're the one doing a brilliant job.

  8. supreme hoodie说道:

    I actually wanted to jot down a quick comment to be able to express gratitude to you for the nice suggestions you are writing here. My extensive internet research has at the end been compensated with reasonable facts and techniques to go over with my co-workers. I 'd say that many of us visitors are unquestionably lucky to be in a decent site with so many lovely professionals with helpful things. I feel rather fortunate to have discovered the web pages and look forward to so many more pleasurable moments reading here. Thanks a lot once again for a lot of things.

  9. Milan Pangan说道:

    It's appropriate time to make a few plans for the long run and it is time to be happy. I've read this submit andif I may just I wish to recommend you some attention-grabbing things or tips.

  10. birkin bag说道:

    I precisely wished to thank you so much once again. I'm not certain what I could possibly have accomplished in the absence of the type of tactics discussed by you over that concern. Certainly was a very challenging setting in my position, but viewing a specialized way you dealt with that forced me to weep over happiness. I'm happy for your help and have high hopes you know what an amazing job you were getting into educating many people using a blog. I'm certain you haven't got to know all of us.

  11. lebron 15说道:

    Thanks so much for providing individuals with an extraordinarily splendid opportunity to read in detail from this site. It is always very pleasing plus full of fun for me and my office friends to visit your website minimum three times every week to read the latest stuff you will have. And lastly, we are always astounded with your effective methods served by you. Certain two facts in this article are particularly the most efficient I have had.

  12. jordan shoes说道:

    I precisely needed to say thanks once again. I'm not certain the things that I would have sorted out without the type of methods discussed by you about such subject matter. It was actually a real troublesome situation in my view, nevertheless coming across a new skilled form you resolved the issue made me to leap for happiness. Now i'm grateful for this support as well as believe you realize what an amazing job you are putting in teaching people via a site. I'm certain you've never met all of us.

  13. nike shox outlet说道:

    I wish to point out my admiration for your kind-heartedness supporting those who really want assistance with this particular study. Your very own commitment to getting the solution across appeared to be exceedingly good and have continuously enabled some individuals like me to achieve their aims. This interesting instruction means a whole lot to me and further more to my fellow workers. Regards; from each one of us.

  14. kobe 11说道:

    I precisely desired to thank you so much all over again. I am not sure the things that I would have used without the type of suggestions provided by you relating to this area of interest. It was actually an absolute horrifying scenario for me, however , witnessing a new skilled tactic you resolved that made me to leap with contentment. Now i am happier for this help and in addition expect you recognize what an amazing job you were doing training the others through a web site. More than likely you haven't got to know any of us.

  15. yeezy boost 350说道:

    I intended to compose you a very little observation to give many thanks the moment again for the wonderful opinions you have shown on this website. This has been so particularly open-handed of you to convey freely all many of us might have advertised as an e-book to earn some dough on their own, mostly considering the fact that you could have done it in case you wanted. These good ideas also served to become fantastic way to be sure that other people online have the identical interest like my personal own to learn more around this problem. I believe there are many more fun sessions in the future for folks who look over your website.

  16. I needed to create you that bit of observation to help give thanks the moment again for your amazing thoughts you have shared at this time. It's really wonderfully open-handed of people like you to make openly just what a few people might have made available as an e-book to end up making some money for themselves, chiefly given that you might well have tried it in the event you wanted. Those ideas in addition worked as the good way to be aware that many people have the same dreams the same as mine to figure out whole lot more with regards to this problem. I believe there are some more fun opportunities in the future for people who check out your blog post.

  17. kyrie 4说道:

    I simply desired to thank you so much yet again. I'm not certain the things that I would've gone through in the absence of the entire ways shown by you regarding such subject. Previously it was a distressing case for me, nevertheless considering this well-written approach you managed that took me to cry over contentment. I am thankful for this advice and even wish you find out what an amazing job you happen to be getting into instructing men and women by way of your blog post. I am certain you haven't encountered all of us.

  18. ysl handbags说道:

    I am writing to let you be aware of of the beneficial experience my friend's child obtained reading yuor web blog. She even learned a good number of issues, not to mention how it is like to possess a marvelous coaching mood to get a number of people with ease completely grasp chosen impossible topics. You really surpassed her expected results. Many thanks for providing the practical, dependable, edifying not to mention easy thoughts on that topic to Emily.

  19. I have to get across my affection for your kind-heartedness in support of individuals that need assistance with that niche. Your very own dedication to getting the solution around had been quite beneficial and have in every case enabled some individuals like me to arrive at their pursuits. This insightful facts indicates a great deal to me and substantially more to my peers. Thanks a ton; from each one of us.

  20. yeezy boost 350说道:

    I precisely had to thank you so much again. I'm not certain the things that I would've handled without those ideas revealed by you concerning such a subject matter. It previously was a depressing difficulty for me, however , encountering this specialized manner you dealt with that forced me to jump for fulfillment. I am happier for this information and even sincerely hope you really know what a powerful job you have been doing instructing many people thru your blog. Probably you've never come across all of us.

  21. KlementinaMooro说道:

    how much does one is cost

    d5cb cheap is overnight online

  22. can you take a is at 18

    b950 is para q sirve

  23. is compro

    b950 kamagra 100 mg is

  24. we like it us made is

    b950 is use in infants

  25. the best site womans is

    0d1c canada is at online

  26. is dosage 100mg

    0d1c is 20mg ligne

  27. cheap is paypal

    58b8 overnight soft is

  28. too much is

    58b8 4 pilules is

  29. is 50 ligne

    58b8 is is bad for the heart

  30. la is es peligrosa

    58b8 get the best from is

  31. is trial pack

    58b8 too much is

  32. dth india price list is

    58b8 is professional pocelui

  33. be is over the counter uk

    9113 discount is at

  34. visit our site sale is

    9113 ato is espana

  35. is 5 mg comprim

    9113 only here be is in the uk

  36. at is from walgreens

    9113 fda approved is

  37. achat is andorre

    9113 what does a 5mg is do

  38. is ati britannici

    9113 is discount tabs

  39. how to order is from india

    9113 online rabatt is

  40. is over the counter mexico

    e558 brand is 100 mg review

  41. is holand

    e558 only for you is pill

  42. is marque deposee

    e558 at is medicine

  43. can you be is in canada

    e558 is salesman movie

  44. is cut in half

    e558 why did top gear take is

  45. 50mg vs 100mg is

    e558 prices on cheap is pills

  46. is 10 mg cost pill

    f80a ranbaxy is sales

  47. cheap is from china view

    f80a sample pack is usa

  48. is 5mg or 10m

    f80a is 100mg suppliers

  49. be 10 mg is

    f80a enter site is free pills

  50. canadian at is uk

    f80a comprar is 40 en india

  51. review of is 5mg

    f80a is brand

  52. is clinical trial

    f80a review of is 5mg

  53. compare prices is uk

    f80a daily is canada

  54. ou acheter vrai is

    2cee is uk delivery

  55. is online pagamento paypal

    2cee is 30 oral

  56. is cost singapore

    2cee is professional at

  57. when will is go at

    2cee mejor pero is

  58. kosten is 100 mg

    c8d8 100mg is kosten

  59. effects alcohol is

    c8d8 expired is expired

  60. is crea adiccion

    c8d8 free online sample is

  61. being is online ireland

    c8d8 get is overnight shipping

  62. only today is be drug

    c8d8 is sex pills women

  63. el is se vende con receta

    c8d8 pfizer is 100mg cost

  64. is brand vs at

    c8d8 isproben kanada

  65. i recommend female is

    c8d8 is wirkung wikipedi

  66. is brain

    c8d8 being illegal is

  67. is prices in usa

    2c67 zumo de is sale be

  68. prescription is

    2c67 is fra england

  69. cheap is pay with paypal

    b6a1 be is bulk uk

  70. best quality is in india

    b6a1 is achat doux

  71. is inde de is

    b6a1 is ohne potenzstrung

  72. che cose il is yaho

    b6a1 is at onlin

  73. click here is cheapest

    f96d is pillola costo

  74. real is online at

    f96d canadain is

  75. 20 mg is pric

    f96d is iop

  76. be super is cheap

    f96d india vendita is

  77. be at is daily

    f96d is ibuprofeno

  78. is france acheter

    f96d is sales australia

  79. is at at online

    f96d is price ireland

  80. good choice is legal

    f96d wow is angioplasty

  81. visit our site is dosage

    3c7e vente de is au canada

  82. uk is sales online

    3c7e is 100mg be

  83. in deutschland is kaufen

    3c7e is venta cuba

  84. can i take is with epilim

    3c7e is

  85. comprar is en tienda

    3c7e is pillen bestellen

  86. generisk is

    54dd prix de is au maro

  87. is with out prescription

    54dd achat is en ligne securis

  88. is pharmacology

    54dd correct dosage for is

  89. comprais super active

    54dd is ato mxico

  90. be brand is 10 mg online

    54dd prix canadien sur is

  91. cost of a is pill

    54dd dovevano comprare is

  92. look here name brand is

    54dd being is soft tabs 100 mg

  93. el is funciona

    54dd being is now

  94. is 5 mg prezzo in farmaci

    54dd la compra is en quebec

  95. vente pillule is

    8d74 history is sales

  96. can you be is melbourne

    8d74 why doesnt is work

  97. is bill me later

    8d74 is sample packs

  98. is vs cialas

    8d74 12 dose is

  99. discount is levitra

    8d74 online is scam

  100. canada is welcome to

    8d74 order is soft tabs

  101. is jelly 100

    8d74 is fr frau kaufen

  102. 12 dose is

    8d74 we choice is 100mg

  103. brand or at is

    8d74 how 2 get high from is

  104. click now being is

    8d74 is genrico indio

  105. is soft tabs ato

    9e6b best place be online is

  106. the best choice is femele

    9e6b be is visa echeck

  107. is dolor cabeza

    9e6b is once a day prezz

  108. the best site at is

    9e6b the best choice is femele

  109. is jus

    9e6b is vente en pharmacie

  110. how often can you take is

    9e6b brand name is lowest price

  111. phone number to order is

    9e6b free is samples uk

  112. how to use is video

    9e6b prix officiel is france

  113. costo del is ato

    9e6b india is barata genrica

  114. traitement is

    9e6b is dependency

  115. recensioni is 5 mg

    9e6b is soft stores

  116. is sans ordonnances

    f612 is prix is levitra

  117. is rabatt

    f612 prix is 50 mg en pharmacie

  118. precio is costa rica

    f612 price of is 10mg

  119. is case study

    f612 brand at is

  120. discount is soft

    f612 red is aggression

  121. is urine drug test

    f612 is macht impoten

  122. at is health forums

    f612 mastercard at is

  123. is price of

    f612 is at 100

  124. niagara is

    f612 pfizer is 50mg reviews

  125. look here canada cheap is

    eb98 r20 is

  126. is 5 mg con alcohol

    eb98 is en comprimes

  127. is 20mg einnahme

    eb98 is tarif

  128. is 20 mg tablet cost

    eb98 we use it is online usa

  129. is order australia

    eb98 is 5mg en france

  130. pilule de is prix

    9f8c pack is trial

  131. mytab ats is

    9f8c suche is kaufe

  132. cost of is versus is

    9f8c is 20mg

  133. is online safe

    9f8c be is online france

  134. comprar is venezuela

    9f8c achat is arnaque

  135. is ska inte

    9f8c at is legal

  136. otc at is

    9f8c at is german remedies

  137. be store is

    9f8c is cheap is online

  138. 200 mg is prostitute

    9f8c we use it is discount

  139. try it is usa

    cab8 kamagra is viagr

  140. we choice discount on is

    cab8 is over the counter

  141. fake is online

    cab8 is efficacit

  142. uk soft tab is online

    cab8 le prix de is

  143. is costo en farmacia

    cab8 is 49 ann

  144. is 20mg testberichte

    cab8 at is canada online

  145. is 60mg sell at canada

    cab8 vendita is in svizzer

  146. venta en quito is

    cab8 be is ghana

  147. is precio farmacia mxico

    cab8 is gnrique 5mg

  148. RannevMooro说道:

    tomar viagra hace dano

  149. RannevMooro说道:

    viagra sildenafil tabs

  150. is preis sterreich

    c471 is 20 mg cos

  151. bph is side effects

    c471 precio is 4

  152. wow is pills canadian

    c471 is 5mg retail price

  153. be brand is mastercard

    c471 wow look it is soft

  154. que es is o levitr

    c471 is acquisto online

  155. usefull link is best price

    c471 is pills sale canada

  156. is generika gnsti

    c471 is brand no prescription

  157. is 20 mg cos

    c471 look there search is

  158. is pills ingreediants

    c471 the best site is tablets

  159. recommended first dose is

    c471 is 5 mg settiman

  160. i recommend search is

    11bf is sales new zealand

  161. be is online with echecks

    11bf is 50mgs

  162. look there rx online is

    11bf is to be in uk

  163. inghilterra is prezzo

    11bf compare is at is

  164. be in real is

    11bf mexico at is

  165. is and sperm count

    11bf link for you brand is

  166. is for women 2012

    11bf is per ordine

  167. is stock symbol

    11bf at is date

  168. peso de pastilla de is

    11bf follow link is 50 mg

  169. celias is

    ef1c le is doctissim

发表评论

电子邮件地址不会被公开。 必填项已用*标注