search

Hebing123 / cve

0 stars 0 forks source link

Reflected XSS Vulnerability in UEditor 1.4.2 #63

Open Hebing123 opened 3 months ago

Hebing123 commented 3 months ago

Summary

A reflected cross-site scripting (XSS) vulnerability has been identified in the UEditor 1.4.2. This vulnerability permits an attacker to inject malicious scripts into web pages viewed by users, potentially compromising user data and session integrity.

Details

The vulnerability exists in the /ueditor/php/action_crawler.php file of UEditor 1.4.2, where the source parameter is used to fetch and process image URLs. The value of source is not appropriately sanitized or encoded, allowing the execution of arbitrary scripts.

foreach ($source as $imgUrl) {
    $item = new Uploader($imgUrl, $config, "remote");
    $info = $item->getFileInfo();
    array_push($list, array(
        "state" => $info["state"],
        "url" => $info["url"],
        "source" => $imgUrl
    ));
}

POC

http://your-ip/ueditor142/php/controller.php?action=catchimage&source[]=%22%3E%3Csvg%20onload=alert(1)%3E image

Hebing123 commented 2 months ago

CVE-2024-7343