ForestBlog icon indicating copy to clipboard operation
ForestBlog copied to clipboard

XSS attacks occur when user profile pictures are updated

Open fiblue opened this issue 3 years ago • 0 comments

1.Edit user information and save it image 2.The profile picture address in the packet capture request is changed payload:1" onerror=alert('xss') class="1 image 3.Any place where the user's avatar is loaded triggers a Cross Site Scripting image 4.User information should be added and modified with XSS detection src/main/java/com/liuyanzhao/ssm/blog/controller/admin/AdminController.java image

fiblue avatar Apr 10 '22 10:04 fiblue