PHPCMS V9 storage XSS

It can be triggered without interaction. Attackers can bypass the filter function and call the administrator. Still rich-text XSS, completely bypassing the filter function and executing arbitrary XSS code. As we all know, phpcms supports contribution, and rich text can be input here. Then I find and extract its filter function, as shown below:

function remove_xss($string) {     $string = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S', '', $string);    $parm1 = Array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');    $parm2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');    $parm = array_merge($parm1, $parm2); for ($i = 0; $i < sizeof($parm); $i++) { $pattern = '/'; for ($j = 0; $j < strlen($parm[$i]); $j++) { if ($j > 0) { $pattern .= '('; $pattern .= '(&#[x|X]0([9][a][b]);?)?'; $pattern .= '|(&#0([9][10][13]);?)?'; $pattern .= ')?'; }$pattern .= $parm[$i][$j]; }$pattern .= '/i';$string = preg_replace($pattern, '', $string); }return $string;}

 

The process of processing rich text is as follows: $ info [$ _ k] = remove_xss (strip_tags ($ _ v, '<p> <a> <br> <ul> <li> <div> ')); first, remove the <p> <a> <br> <ul> <li> <div> labels other than those. Then use remove_xss for filtering. We can see that the remove_xss function seems to have filtered out many keywords, like my favorite onerror is definitely gone. No? Let's take a look at how it finally works: $ string = preg_replace ($ pattern, '', $ string); directly filter the keyword into null. Will this error be made in phpcms? If oneronerrorror is input, the onerror in the middle is filtered out, and an onerror is generated. With this attribute, any xss statement can be triggered. Other restrictions can be bypassed by html character entities. First, the website must have the permission to contribute. Then I came to the submission area (index. php? M = member & c = content & a = published). Click it to submit it. Use burpsuite to capture packets and add info [content] to my payload: note that urlencode is required after adding the packet: then, the administrator can view my article in the related background: It is triggered directly after the page is opened, without user interaction:

To load a remote js exp: Solution: Officially unavailable