Emlog Stored Cross-Site Scripting(XSS)
Description
The client lacks proper validation when storing user input, resulting in a stored xss vulnerability.
Vendor Homepage
1 | https://www.emlog.net/ |
Proof of Concept
- Register and log in as administrator.
- Click “发新文章” on Personal Page.
- Input payload：
1 | ![1](1"><script>alert('xss')</script><img src=") |
Then click “立即发布” botton.
- All users now will trigger the attack code and a pop-up window when they enter the homepage of the website.
