本文介绍了一种在CMS后台通过文章发布模块和用户添加模块中存在的XSS漏洞现象。通过登录后台并尝试发布包含特殊JS代码的文章内容或者添加带有特定输入的用户名，可以触发弹窗等行为，证实了XSS漏洞的存在。
Visit the CMS home page and find that the JS code for the article content section is
Log on in the background, there is an article release module
You can see the successful pop-up window, execute the JS code, and prove an XSS vulnerability
Second XSS
Login background, add user module
User name input content does not do any filtering, new user name:
扫一扫
299
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
