nangge / noneCms

基于thinkphp5.1 的内容管理系统,可快速搭建博客、企业站;并且增加了实时聊天室
http://www.5none.com
Other
273 stars 120 forks source link

NoneCMS V1.3.0 has a XSS vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf #30

Open ghost opened 4 years ago

ghost commented 4 years ago

NoneCMS V1.3.0 has a XSS vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf.

I download the swfupload.swf file and I use FFdec to decompile the file. Then I find that user can control the movieName parameter which will concatenate as the value of flashReady_Callback:

Tracking the flashReady_Callback variable, it will call function ExternalCall.Simple() with one parameter flashReady_Callback:

Then I check the ExternalCall.Simple() function, this is a piece of code that exists a Flash XSS vulnerability:

So PoC is as follows:

http://192.168.203.1/noneCms/public/static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf?movieName="])}catch(e){alert(document.cookie)};//

When NoneCMS administrator visits the link in IE or Microsoft Edge, it will cause xss attack: