CVE-2018-15130

CVE-2018-15130 affects ThinkSAAS up to 2018-07-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter groupdesc in the URL path index.php?app=group&ac=create&ts=do, allowing injection of arbitrary web script/HTML into the page. Root cause details beyond XSS are n...

CVE-2018-15130

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

CVE-2018-15129

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

Code injection

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

CVE-2018-15129

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

CVE-2018-15129

ThinkSAAS up to 2018-07-25 is affected by a cross-site scripting (XSS) flaw in the content parameter for the article comment endpoint (index.php?app=article&ac=comment&ts=do content). The issue arises from user-supplied content being reflected without proper sanitization, enabling XSS. Connected ...

CVE-2018-15129

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

CVE-2018-15129: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

CVE-2018-15130: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

Stored Cross-Site Scripting Vulnerability at the Thinksaas Creation Repository

ThinkSAAS is a lightweight open source community system that can be used to build discussion groups, bbs and circles. A stored cross-site scripting vulnerability exists in Thinksaas version 2.5 at the creation repository, which can be exploited by remote attackers to inject arbitrary web script o...

Stored Cross-Site Scripting Vulnerability at Custom Inputs in Thinksaas System

ThinkSAAS is a lightweight open source community system is a community system that can be used to build discussion groups, bbs and circles. A stored cross-site scripting vulnerability exists in Thinksaas version 2.5 at the system's custom input. The system uses a blacklisting mechanism to filter...

ThinkSAAS中tsUrlCheck()函数引发注入漏洞

No description provided by source...

ThinkSAAS最新版2.4 Xss漏洞

简要描述： 未过滤 详细说明： 先看写入代码： /var/www/html/thinksaas/app/my/action/setting.php case "citydo": $province = trim$POST'province'; $city = trim$POST'city';//只过滤两处空白 //这里就直接写入数据库了 $new'my'-update'userinfo',array 'userid'=$userid, ,array 'province'=$province, 'city'=$city, ; tsNotice"常居地更新成功！"; break; Updat...

ThinkSAAS最新版2.4 Xss漏洞 指谁打谁

简要描述： thinksaas2.4+php2.6+apache2 未过滤 感谢@xfkxfk 详细说明： 先看消息写入代码： /var/www/html/thinksaas/app/user/action/message.php case "do": $msguserid = $userid; $msgtouserid = intval$POST'touserid'; $msgcontent = tsFilter$POST'content'; //用tsFilter过滤 aac'system'-antiWord$msgcontent; //过滤垃圾词...

Multiple Vulnerabilities in the Latest Version of ThinkSAAS

ThinkSAAS is a lightweight open source community system , can be used to build discussion groups , bbs and circles of the community system . ThinkSAAS latest version of the existence of multiple SQL injection, arbitrary file containment and arbitrary file deletion vulnerabilities. Attackers can u...

ThinkSAAS SQL Injection Vulnerability

ThinkSAAS is a lightweight open source community system , is a community system that can be used to build discussion groups , bbs and circles . ThinkSAAS has a SQL injection vulnerability. An attacker can exploit the vulnerability to execute SQL statements and obtain sensitive information from...

thinksaas最新版存储xss

简要描述： 过滤不当 详细说明： 最新版下载地址http://www.thinksaas.cn/service/down/ 跟前面thinksaas最新版xss2 WooYun: thinksaas最新版xss2 thinksaas最新版xss WooYun: thinksaas最新版xss 原理都一样 吐槽下 官网不让注册帐号 就在本地测试了 前人的我测试一个现在还可以 当然 漏洞文件肯定是不一样的 漏洞文件 在app/article/action/add.php 25行中没有过滤 48行插入数据库 isLogin; switch $ts case "" : if...

ThinkSAAS通用按钮储存型XSS

简要描述： 至少有4处以上 详细说明： WooYun: ThinkSAAS存储型跨站2处 这个位置现在已经修复过，直接输入javascript被过滤而引发上次问题没过滤的&被转译成&所以上次的payload已经不适用了 发现这个点是基于黑名单的过滤，黑名单的过滤肯定会有考虑不到的地方 这次将payload转换为data:text/html;base64, PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPg== 这样的话一样可以触发xss 漏洞证明： 这个问题通用地存在所有有插入超链接这个按钮的位置...

ThinkSAAS 最新版注入

简要描述： ThinkSAAS 2.4 详细说明： app\group\action\add.php 60行开始 // 执行发布帖子 case "do" : ......省略...... $groupid = intval $POST 'groupid' ; $title = trim $POST 'title' ; $content = tsClean $POST 'content' ; $typeid = intval $POST 'typeid' ; $tag = $POST 'tag'; ......省略...... // 处理@用户名 if pregmatchall '/@/'...

ThinkSAAS SQL注入

简要描述： ThinkSAAS SQL注入 详细说明： 版本 ThinkSAAS 2.32 目前最新版。 app\group\action\do.php 281行 //回复评论 case "recomment": if$POST'token' != $SESSION'token' echo 1;exit; $referid = intval$POST'referid'; $topicid = intval$POST'topicid'; $content = tsClean$POST'content'; $addtime = time; $db-query"insert into...