Webasyst 2.9.9 has a storage XSS vulnerability,Attackers can create blogs containing malicious code after gaining blog permissions, and even administrators only need to open the page of the blog management function (instead of the specified blog) to be triggered!
Details
As you can see, $icon_uri is not filtered in blogHelper.class.php and is concatenated directly into the i tag.
When testing, remember to change the _csrf and Cookie Header in the POC to the corresponding values.
Impact
Create permissions to create malicious attackers hold blog blog, blog management function will be affected, the administrator will trigger open http://ip:port/index.php/webasyst/blog/ (0-click).
Summary
Webasyst 2.9.9 has a storage XSS vulnerability,Attackers can create blogs containing malicious code after gaining blog permissions, and even administrators only need to open the page of the blog management function (instead of the specified blog) to be triggered!
Details
As you can see,
$icon_uri
is not filtered in blogHelper.class.php and is concatenated directly into the i tag.We can close the previous i label by
"
and>
.Proof of Concept (POC)
When testing, remember to change the
_csrf
andCookie
Header in the POC to the corresponding values.Impact
Create permissions to create malicious attackers hold blog blog, blog management function will be affected, the administrator will trigger open http://ip:port/index.php/webasyst/blog/ (0-click).