Qibo CMS_V7 can kill xss (where to kill it) by getshell.

0x01_XSS

Qi Bo uses the Rich Text Editor CKeditor. In fact, it has already filtered out other common input points. However, during the fuzz test, it was found that the editor was not filtered out after the source code was submitted, the editor is applicable to the entire system.

For example, Short Messages (target users can be specified)

 

 

 

 

This editor is also used to publish articles and other places.

 

 

0x02_getshell

 

Qibo cms can enable the static mode in the background, but the static file suffix can be defined by itself. After changing to php, the parsing will be correct.

 

 

 

0x03_xss combined with getshell in the background

Capture the packet and check the background getshell. Combined with the payload of the previous xss getshell, you can write the xss getshellpayload for qibo CMS_V7.

(I won't say it is because I am too lazy to capture packets and rewrite payload =. = 23333)