华天动力储存XSS10处打包（6处绕过长度限制），非self-xss（demo演示）

### 简要描述： 缺个移动硬盘存片子 ### 详细说明： demo演示，涉及大量政府，医院，房产，电视台等网站：http://www.oa8000.com/solution.htm [<img src="https://images.seebug.org/upload/201501/2314291643cf5ec385d8eae4a748318a4ceb288e.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2314291643cf5ec385d8eae4a748318a4ceb288e.png) [<img src="https://images.seebug.org/upload/201501/23142924074096d19b905f3f564edecd20cc9e0e.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/23142924074096d19b905f3f564edecd20cc9e0e.png) [<img src="https://images.seebug.org/upload/201501/2314293210b2b44fd90a28be81d6725e27af2a81.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2314293210b2b44fd90a28be81d6725e27af2a81.png) 首先还是来到官网，看到demo演示地址：http://demo.oa8000.com [<img src="https://images.seebug.org/upload/201501/231429506b770292f8255a79101a85aa9062615d.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/231429506b770292f8255a79101a85aa9062615d.png) 然后先用官方提供的普通用户登录 [<img src="https://images.seebug.org/upload/201501/2314300130decd0c53fe0d5cf942041d5c4c7fb4.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/2314300130decd0c53fe0d5cf942041d5c4c7fb4.png) 存在XSS的地方在：客户管理----联系人管理----我的联系人----新建 [<img src="https://images.seebug.org/upload/201501/23143011e2a7e6e7691ca10940d39c4cefb9120e.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/23143011e2a7e6e7691ca10940d39c4cefb9120e.png) 这里新建一个联系人，然后盲插一下= =`"/><script>alert(/1/)</script>`但是只能盲插4处，其余6处均有25字节限制 [<img src="https://images.seebug.org/upload/201501/231430560e933ba687a83fbc7f523bd31ab3cb33.png" alt="7.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/231430560e933ba687a83fbc7f523bd31ab3cb33.png) 25个好突破。。,直接插入：`<svg onload=alert(/1/)>` 后成功保存~ [<img src="https://images.seebug.org/upload/201501/23143108b35a1ed5fb543b542b9d5788478fb844.png" alt="8.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/23143108b35a1ed5fb543b542b9d5788478fb844.png) 保存后返回直接连续弹窗10次 [<img src="https://images.seebug.org/upload/201501/23143117026d9b1ca1bdde9e31a7ac1ac0c94c51.png" alt="9.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/23143117026d9b1ca1bdde9e31a7ac1ac0c94c51.png) 为证明非self-xss，接下来登陆demo提供的管理员账号查看一下 [<img src="https://images.seebug.org/upload/201501/231431259c867fa8ef797114d4b8e57a65003841.png" alt="10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/231431259c867fa8ef797114d4b8e57a65003841.png) 成功弹窗~ [<img src="https://images.seebug.org/upload/201501/23143134a2335d515361fc9198aa2ab04df7a2ff.png" alt="11.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/23143134a2335d515361fc9198aa2ab04df7a2ff.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201501/23143134a2335d515361fc9198aa2ab04df7a2ff.png" alt="11.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201501/23143134a2335d515361fc9198aa2ab04df7a2ff.png)