### 简要描述:
rt
### 详细说明:
在发布文章处,插入xss代码
[<img src="https://images.seebug.org/upload/201501/1615304657122c9ba9810931f35408f3e4d07c08.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/1615304657122c9ba9810931f35408f3e4d07c08.jpg)
然后查看文章,直接执行了插入的js代码
[<img src="https://images.seebug.org/upload/201501/16153214c65862ff23f38e37e3df222cd93f296d.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/16153214c65862ff23f38e37e3df222cd93f296d.jpg)
在测试demo的时候被阿里云的防护拦截了
### 漏洞证明:
[<img src="https://images.seebug.org/upload/201501/16153550043c975cdbf9e965b2a322c4bb2dc50a.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/16153550043c975cdbf9e965b2a322c4bb2dc50a.jpg)
[<img src="https://images.seebug.org/upload/201501/16153617d980aab272a1631bba19d5852149e821.jpg" alt="4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/16153617d980aab272a1631bba19d5852149e821.jpg)
暂无评论