Description

Stored XSS via uploading file in .ofd format.

Proof of Concept

filename="test.ofd"

<script>alert(1)</script>

Steps to Reproduce

1. Login into showdoc.com.cn.
2. Navigate to file library (https://www.showdoc.com.cn/attachment/index)
3. In the File Library page, click the Upload button and choose the test.ofd file.
4. After uploading the file, click on the check button to open that file in a new tab.
5. XSS will trigger when the attachment is opened in a new tab.

POC url:

https://img.showdoc.cc/622f5237a4612_622f5237a4609.ofd?e=1647272323&token=-YdeH6WvESHZKz-yUzWjO-uVV6A7oVrCN3UXi48F:0OnGqbEWkwJaFbR43A347gUCOMc=

Impact:

An attacker can perform social engineering on users by redirecting them from a real website to a fake one. a hacker can steal their cookies etc.