1.3K Star 6.3K Fork 2.2K

GVPKarson / FastAdmin

 / 详情

There is a xss vulnerability on the page of user

已完成
创建于  
2018-04-20 10:20

after the member logged in ,he can change his message, such as avatar,nickname.and we go to the file application\api\controller\User.php in the function of profile

  public function profile()
    {
        $user = $this->auth->getUser();
        $username = $this->request->request('username');
        $nickname = $this->request->request('nickname');
        $bio = $this->request->request('bio');
        $avatar = $this->request->request('avatar');
        $exists = \app\common\model\User::where('username', $username)->where('id', '<>', $this->auth->id)->find();
        if ($exists)
        {
            $this->error(__('Username already exists'));
        }
        $user->username = $username;
        $user->nickname = $nickname;
        $user->bio = $bio;
        $user->avatar = $avatar;
        $user->save();
        $this->success();
    }

there may no restrictions.we can control the value of avatar.

1

then the member go to the url 'http://yoursite/public/index/user/profile.html'

2

and After the administrator logged in,if he double-click the member's avatar

3
4

or request the url of 'http://yoursite/public/admin/user/user/edit/ids/2?dialog=1' will trigger the vulnerability

5

评论 (1)

myndtt 创建了任务
myndtt 更新了任务

@myndtt Thanks for your feedback,We'll repair it on next commit!

Karson 关闭了任务

登录 后才可以发表评论

状态
负责人
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
参与者(2)
10933 karson 1578914737
PHP
1
https://gitee.com/karson/fastadmin.git
git@gitee.com:karson/fastadmin.git
karson
fastadmin
FastAdmin

搜索帮助