DzX 2.0/2.5 kills one 0day stored XSS

The vulnerability occurs at the place where attachments are inserted. When talking about inserting attachments, you should have thought of the file name. Because the file name is displayed according to the locally uploaded file name. If your operating system is linux, you can directly modify the file name of an image file, such as: 1 . png (here/in linux, it will be converted to: This payload can only be played under IE6, and I know you are experts who can insert advanced payload as needed) if your operating system is windows, you can use your preferred packet capture tool (I personally prefer to use Tamper data ). The first upload should be unable to catch the file name, at least I did not catch it. Therefore, you need to re-edit your post after uploading, inserting, and posting to update your image. At this time, you can capture this cute filename by capturing packets. Modify xxx.png to 1 . png submit. Xss will be triggered on the second page, that is, after you click the image to enlarge it. Pwned! The character length is limited to about 80 characters, and "'/etc .. is filtered out .. (I will continue to describe the question of slashes later.) Because I Don't Know XSS, I will show some of my friends to construct payload, which means that slashes are filtered, and the character restrictions on cloud basically fail. Although XSS is very popular now, I personally don't really like it. However, if you say no, you have to give it a try again. When I found that the backslash was also filtered during the attempt, I found that this is not an xss filter problem. But during the upload process, our cute/and backslash should be used to split the filename and filepath, so it is also appropriate to be killed. Orz .. this seems to be the legendary mission impossible. We need to solve the problem of this slash. After a variety of attempts, I finally went back to the appendix description. It is uncertain to insert an XSS payload. Like this: 1 . The original file name of png is overwritten by this description. Pwned! Www.2cto.com and we can bring our slash (because it is no longer the case above) Here, I think there should be no obstacles. Some people may have said that payload will be leaked on the home page with HTTPonly cookies, which is a passive cloud trigger. Whatever! I don't think it's time to study these issues. Because no website has such a big hate with you.Solution:Global-upload settings-Forum attachments-show image attachments in the Post-this is done. I hope you will learn to pay attention to copyright. Because respect is the foundation between people.