Discuz full-version storage-type dom xss (accessible as Administrator) with Discuz official development 4 pitfalls & amp; verification script

Discuz full-version stored dom xss (accessible to administrators) with Discuz official development 4 pitfalls & verification scripts

Storage-type XSS caused by improper processing of Discuz editor JS.

Cause:

Js native method of retrieving HTML content in ELEMENT will reverse the entity encoding of a single double quotation mark escaped by the server.

Code Analysis:

Here, we use the latest version to test payload: [align = "onmouseover =" alert (1)]

On the official forum site, the code was quietly changed from, causing the above payload to be filtered. However, use 2 to bypass it.

/Forum. php? Mod = post & action = edit & fid = xx & tid = xx & pid = xx & page = x

/Static/js/common. js:

/Static/js/bbcode. js:

/Static/js/editor. js

Debugging process: