SDCMS 最新门户版 V3.0 储存型xss一枚 可盲打后台

### 简要描述： 严谨的说 是编辑器xss储存型漏洞 ### 详细说明： 虚拟主机搭建测试： 需要条件： 开启会员注册(默认开启) 开启投稿功能（默认开启） 下载地址： http://www.sdcms.cn/product/portal.html [<img src="https://images.seebug.org/upload/201502/27121158008aa85d9a18645b0706bcc53a924e99.png" alt="QQ截图20150226225546.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27121158008aa85d9a18645b0706bcc53a924e99.png) [<img src="https://images.seebug.org/upload/201502/2712124248b61d200b0f68304166554595b63190.png" alt="QQ截图20150226230019.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/2712124248b61d200b0f68304166554595b63190.png) 默认 开启会员注册 无需审核 原本想在demo上测试的 但是他开启审核了 ---------------------------------------- 注册个会员 找到在线投稿 [<img src="https://images.seebug.org/upload/201502/27121301b88a24cf535ec655440a379b7c6fb83d.png" alt="QQ截图20150226230518.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27121301b88a24cf535ec655440a379b7c6fb83d.png) 选择文章模型 远程上传地址处 插入： ``` "><img src=ss onerror=alert(document.cookie)> ``` [<img src="https://images.seebug.org/upload/201502/27121334663d26a82a457aff306645ce497b6369.png" alt="QQ截图20150226230654.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27121334663d26a82a457aff306645ce497b6369.png) 提交 [<img src="https://images.seebug.org/upload/201502/27121414d187efe7e7fb64a09e7b77ce62ca3c1c.png" alt="QQ截图20150226230836.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27121414d187efe7e7fb64a09e7b77ce62ca3c1c.png) [<img src="https://images.seebug.org/upload/201502/27121433e1996594fc92a51a68b9edcdd8c822af.png" alt="QQ截图20150226231051.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27121433e1996594fc92a51a68b9edcdd8c822af.png) 投稿后 需要管理员审核 我进后台 查看 [<img src="https://images.seebug.org/upload/201502/27121450cb00bcbef6f1bedbed8cdccff6d70eea.png" alt="QQ截图20150226231220.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27121450cb00bcbef6f1bedbed8cdccff6d70eea.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201502/27121450cb00bcbef6f1bedbed8cdccff6d70eea.png" alt="QQ截图20150226231220.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201502/27121450cb00bcbef6f1bedbed8cdccff6d70eea.png)