There is a xss vulnerability on the page of user

after the member logged in ,he can change his message， such as avatar,nickname.and we go to the file `application\api\controller\User.php` in the function of `profile`
```
  public function profile()
    {
        $user = $this->auth->getUser();
        $username = $this->request->request('username');
        $nickname = $this->request->request('nickname');
        $bio = $this->request->request('bio');
        $avatar = $this->request->request('avatar');
        $exists = \app\common\model\User::where('username', $username)->where('id', '<>', $this->auth->id)->find();
        if ($exists)
        {
            $this->error(__('Username already exists'));
        }
        $user->username = $username;
        $user->nickname = $nickname;
        $user->bio = $bio;
        $user->avatar = $avatar;
        $user->save();
        $this->success();
    }
```

there may no restrictions.we can control the value of avatar.

![1](https://gitee.com/uploads/images/2018/0420/100313_875b3616_1890460.png "MKG7(EIL_41QJ(1B9YWG~(R.png")

then the member go to the url 'http://yoursite/public/index/user/profile.html'

![2](https://gitee.com/uploads/images/2018/0420/100619_e54d498e_1890460.png "2AU]}2`A4A`O{HKMK1I@]`H.png")

and After the administrator logged in,if he double-click the member's avatar

![3](https://gitee.com/uploads/images/2018/0420/101449_a37f761b_1890460.png "35G]LUD`NA9VN2MTRP0@VVX.png")
![4](https://gitee.com/uploads/images/2018/0420/101644_0d732b55_1890460.png "6_WM(`KN`XUN%Y[R{QA7}O1.png")

or request the url of 'http://yoursite/public/admin/user/user/edit/ids/2?dialog=1' will trigger the vulnerability

![5](https://gitee.com/uploads/images/2018/0420/101536_cdee3c34_1890460.png "M8BONXZ[S@9`DV(WZTX(FK4.png")

GVP FastAdmin 开源后台框架/FastAdmin

Content Risk Flag

Comments (1)

GVPFastAdmin 开源后台框架/FastAdmin

Content Risk Flag