VULHUB ™

安装好whitelable主题之后漏洞文件位置是: `/whitelable-framework/inc/snippets/form-sharebymail_iframe.php` Line 48 ~ 50: ``` $recipient = $_POST['recipemail']; if (stripos($recipient, ',')) $recipient = substr($recipient, 0, stripos($recipient, ',')); ``` 可以看到这里POST方式接收到的recipemail只是去掉了逗号之后的内容然后就直接存入变量$recipient Line 86: ``` <div id="confirmation">Your Message has been successfuly sent to <?php echo $recipient ?> </div> ``` 直接将未转义的$recipient输出造成了xss 复现之后发现这个漏洞只是一个很鸡肋的self-xss...不过既然提上来了还是分析一下

安装好whitelable主题之后漏洞文件位置是: `/whitelable-framework/inc/snippets/form-sharebymail_iframe.php` Line 48 ~ 50: ``` $recipient = $_POST['recipemail']; if (stripos($recipient, ',')) $recipient = substr($recipient, 0, stripos($recipient, ',')); ``` 可以看到这里POST方式接收到的recipemail只是去掉了逗号之后的内容然后就直接存入变量$recipient Line 86: ``` <div id="confirmation">Your Message has been successfuly sent to <?php echo $recipient ?> </div> ``` 直接将未转义的$recipient输出造成了xss 复现之后发现这个漏洞只是一个很鸡肋的self-xss...不过既然提上来了还是分析一下