There is a stored xss vulnerability exists in jfinal_cms

[afeng2016-s]

[Suggested description] jfinal_ There is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code. via a Google search in url:http://localhost/jfinal_cms/admin/site/save/5

[Vulnerability Type] Cross Site Scripting (XSS)

[Vendor of Product] https://github.com/jflyfox/jfinal_cms

[Affected Product Code Base] Less than 5.1 0

[Affected Component] POST /jfinal_cms/admin/site/save/5 HTTP/1.1 Host: localhost Content-Length: 1777 Cache-Control: max-age=0 sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBl1vjLCSUZbB3vef User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: http://localhost/jfinal_cms/admin/site/edit/5 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 ...... ------WebKitFormBoundaryBl1vjLCSUZbB3vef Content-Disposition: form-data; name="model.name" 博客 //your xss payload ------WebKitFormBoundaryBl1vjLCSUZbB3vef Content-Disposition: form-data; name="model.site_title" ...... ------WebKitFormBoundaryBl1vjLCSUZbB3vef--

[Attack Type] Remote

[Impact Code execution] true

Click the Save button, because the developer does not filter the input parameters, the input malicious code is parsed and executed.

Test the reflection cookie through XSS again.