安全研究
CVE-2023-24488 QR Code Generator XSS：code-projects.org 项目的 Stored XSS
Thinking
2023-02-21
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
code-projects.org 上的开源 QR Code Generator 在生成 QR Code 预览时，把用户输入直接拼到 href 链接——攻击者写一个 javascript:alert(1) 进去，QR Code 一被扫描就是 XSS。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247687cb8e22600cc05eab1adfa70e1b3ec5310e9685334495f6ee65e2922932a82d43b772c0848d57d1311d6c58a543ce0b589f51c91a3c4019be62d3b6f030a5e3b5ebd7166e90c59293d2e51b6ff6d389ecb4ddaf0ea82fadf7af39b9b6cf9e22ca5ab15bdc21ac82b8acedf3b54592a5f9538c944776972d58dce1de2a2afdeba63e32b0a6544e458605ee62254a160a208ff68ffb5748d6f8eb5e9efdfd557eb83463c313bb8c01a5848e98d798d6ba56684c2d27e00d4e04dfe11b694d53147bafd15e6e248d7952868138e4efe040e1128129755f89a63e9b026aa981af2729889f69eb9759a06ff537cb2ff2e9562f9571ab27e1bce0979cb9bca3d8b4d9a70613500096cefa035bbcb28316ccf7276034b3dc66f678eec6a965557b7ffbae619f1b3c5fb727a3d64b6f4dd91d0e7992c64180f4af7327ffb5098923434fecdbdf3e4d12b0b0ad97610e6b2162249183a9161bb77bd5a1eb597b46356332b1c9f0af478767e11979dfcf164996222652bf9864e389067df2cdf866750143e399c7cca18ae53a8a30dbcffead5ae42d2dfad31f8bc5a8e1a1db4f7a70c77056137841a13def4f5fd205d063b2d746989e15757e10d0cfb8eaab6918798457ff39c13c9a24ad25d87ea708ce9b7c9f6abdffa52e3543ae73ed330cb1c19f24febc7bdfe1cc7ae4e8403f949056e8067e642e445c3772271fb6c5c42ac8e8507cbd6038fc6ec1b1ada2129a8b648733b911bacfadb74aa3d0a6d20eb1d91c7a5a03cd32394747cb2a770894b34d8a896cfb2506b67df6ee88394b315a35c2613b041c39a2cc3f4e8be35e32d781440177555ccdfe0e565bb70767c2992a3a18eb3aafafed9304cf3adfc8fbb9b94dba37b9103de02a468e7b881adcc1d7c7515c5a2c49e91ce7cc942fd6d9cf5db01ed5821f71dc540c3125e48ed34f5d6510009b16491e6059041eed95b61bbc8a84f12ee1c358556cb14e4a82f0611e1ccd3a3d22bacb1fc81dab677a73ec3702c666bb9f3c3b47f04102cafad06e6f7426a4f32a4b0eeae364c8411868c1faa6e1686833f465d5728b3e3b4fe43365b0838e07c8dc893a26d3cd19161db727ba415ba1ded63496d755e6c965b41bdd8fc98a14948dcc7172500622d54e0ddafc514a6a7916e2ccd93d78deed865d694e46b19357403a5f286a69620b1d5c3a13158e769e91652ed6bc8903e754ae4712931068dc0c94b6ceb6e7541270cbf1a514dac269570c99220760e2158521363110422c3fd3f955024bae35e0c0c997f758aca1190c47ba07ce14508223bd3292d897dea07169559a2e85e7837e3a5f79e0f9d150711fec2672a50bdc56922f55e05b2d0a20b0c84835fa9225e795d2f981e2d60921b5fb72fe520c30fd1fdb895506463a7567b9cc94606384021eede2ecb1417a06f22e8016aae41f72ebfc1afac20f94290b3ab10405aea56bf44aecfcd7939f1b5cf5d626aa2d8da00e48fbd50533c502a43d4b3372cf542264bffcdfbad81a55986e31368dc080848a9a34df5175c3800fe8808d2b564bb8225226cd6531ec40bf768a38cdea47851808b0d94e1a69dc145b23b3cc5f26ad3c1146f0bf728b1ef66830bb47f7743b3cc45a4aa31f02c6e83c569657e264d5c95da603eb18bf705f01858a41690c2d102368a6243fad0da96ec862cca932773ae2958baa3627407377f0160721ffc32c9ab0594df8c0b3e7b5d38199c0c315d69aff2f0feab52790fd35127095b9453c93db239e529af234c6a6e26788797c130a97b49c12e126055313791663cea0103536fc5d200b7d60e9f9af092e63302c995d967f15b110a5fd5b9682f26a954a9cf861cca53a61cad5f3922f1cbd6c8c9cc8dc6147aa4cde2c89c47242be848378ef5d2246c9526f48d746e63b10dc88e322b8a37879541a995310e795fa0dabe79280d4f169e91ed1b90873fef515e7fe7185c1eb856b630363fe4d3e5f033633cff8cd70cd9a95cdfdb24fbfeb5cc7aac3196a0a699132784c398f4f60bedd5639b96de0e5e41fa386ca8b69641811e3da8a51e5c71742e4b6f78cc9db0ef2e79045c438964874c041e9d1eb400fe8397a74a5c59888d507aaf6d3a754a45367e7107276891e7f75b65049d0c1bc8d0e7acfa09bf8eda1c408a76e839b8eb7dc62d762baa0f3fa5de6713f349c1521d5c04b56636173c643bb2708a4e13069b9c58ca8524660438040bfd82f3cf3eddee264673c63f8b3629bbc79c92b6d1b381cf340b2a320a513912ef3e8a97ce52483f5715b7a200dcc816865cca8f078ce95b350278d8284c1240c38e4d7190c1c1ad37c51788d68bb4a3c743ac5c6b1744589e093aae3636c201b06be7c0e8436ba557f43be30719377025d1ea8181e86f9c76f0e448006d5bc9ab0b77cf975dc218d79fdd8eecb70ac53e686c67f1a1e8b1ed38aef15cbc7d0bf00739d8f76abca53e4f1b2487c312131f90410ed304f7f9456116cd0fd51c9241bebfd5ec6496b6b8b7b7fc5b3400046e8fa1369ee3f4b0f12cc9bfc65c158df9107f4b4e7a3e88e69342e509c0830a0995710ec1e6ab9df2964eb549ed37c5a3da88bcada88f4fde11fd4302816630478fa9da601e5019060c5ac6db527407ac0d3c9d8ba6f60e68e5b20c6a200766f35ce3c7e3c6db7ae6d4f6aa5e8106f38a2d03983605f8619839f70f34551355607b64634a6bc4293b81541e6d404851d2a2cbbbed721495c71b74102c056d805b9c10f290c932257453057fc54ae70691e01ebee6eeb8addde51a0574155b11f47f0283478e162bb27a774c25b43e9a1086e9239cd9b629759306a8e2b42faca0ff9a3670334e63eb044e90e34926458b0130795738d577e12dfaf8073a99767e8c85651ff652f9772e0441975a8a0c87f3a9816d2735bc53481974f557b80a6f12d5858f75ad6ecbc48a5832feb65d64f89ea4d3d607ae1f1147fec1fe4a885b6ffa3a5cbedd36f1150cb66221b9c8b258320f850e84feac36dfaa7dcdc6c72210805a716eefe0e2b00cbb30e71a50f96d689965bf548aae78e6533b3ef092514ab8c5d9b40af621b83ad9fbbf7c3125b37cd2dcdcbaf3d4c8701e35f253f2de2c8768503be8de98b104c98d685bbadfabf7a361ed0bd57416e51da432d100688c4485ef7465a1aad4a75068b161dd5bbbd3f14c5ff18bf1bb76b0b2713ec28bb6b1c244c93b42a6ad023777231851d1a9fc7961c863df174b1adb321368653515bf4cf115bf6ca83937d2b0e1ac812eef168685f64ff5fdbe5da2bf5b1eeaa0c3d0c604405e05171f4f032378be8cfc5abd2ef31cfe3f289b6e05a1e62a3e03df538a9bca12fde606a7f8768551e7676f6d1f0e8a11ac9596c5632cc091d598e1dfafb20e63f09c4cca72e3fbd86521b6926b67cf3bc7d9d19e206b8ef2832c421609996bff02665218b22d2c1db0e86099fcd8b7239106fa01457ff5cb855798d8d21c5113a68253912c9f8f2274d4e478aaca8df7f074cdd1a736d2bf18122f458acc2ca703e8c43f201ba011b4c0060bc5577f11e23ccb59799e7c6efc4d16edd61e8e45bb33612009ed6fe774adbc31254b2cb2934a545274942edcff08f72ac8988beb6bb5ca10892819afc3b2d457fe1e0136f76720cfc85e5d3832dde0572672df8acc36ea24af6b0d7537697697f027112e4025031621aed31c0583a5ead7618164ea56d4984b06a3be8558b779f92eec5b2f53c415ee5ce4e80cbeb0c4227cb1ba0c7276889ce9872ab35dd996319cb17a90d963a62ce4b253bd7e7ce347c19e409d815ece8cfea7cdc08e7998f96cd0e2fa819fb0575123900d21da932fe81fd687cc4fa5b744f8e5d594dae6916f3b58b04ad15512fce0a1f4fd126a64874d32dc841cf18f6e5a54bbbe3d18f98301092e6820b5c158d4c3a427c71e1f19fad9a26314b97398018461947f62f8ac7871c6bc01861944b0b332f3e034d3a4f8b046b31204965941b761cdcd92780537f923b6fb35ffb18d369b515605c1e80a48bb4ddfddb53367ee7a32d2be267d893d878d65f620b6ded8b99dda9b4614d47d8457b31dff6268cece21189e3d500c9691ff1e7a7ead7abaeb89e11a4a480b10bcc62f6a6589f836350775cc6be6e65042ad10c07b261aefa09c61dc586b10bf1b450ff5fe3aee63330dbb1194532e81188c2c0d2d8e990e13f76dac9d110dcc2bf413f3dce2e44eb00870b72ba88c3170e43d8951340f126ad2cb958c56427cf6294bc35ba17785a0a0e283a8050ff430dd401d06d110f0deb7f750187b6e4f81623c339e7258c16c24570eae014ee53145419a89933121adefc1738474b251f8ab38a0cc3e293ae5dfc0265f3af7e80fe0612c3caaf03d8b8e80b8b093f4f623a56219e944ec5a427d0520f5569909ec9f12b46f671606637a776169ead60f563e8e83a460ceb1f594d4948003f2cc92569bcd11baf5dbbc947330d5d2963352ff956de854ab5b631efd6fc620c36c5f62cbfa5719ed4f0db12b250f2f8d75eddd8b6f2e13440c081f282471a8ec542e6a476cb4a29cf7273b3c0ccb832aab4b3493bc4e0ccb532b88f5b66bd8e6c900840806039ddb1f9f1d604fcf3a7214d1ac16a7e5df2c6ea1be60013dd9151aa654768d70db925f8cf28b6a3df3485819589220a8f290f3f1555596a182773baa5ebcd08730816d6b37505dfe311ec8100ad34e285aa087c9c4bd002e74d7106366a1b71716328b4b1862678e9772b4ac9efadddd115311a2d8deb49b6054b3e9de905b69451d57b9d0518babd79025e4b3ab6b477b005e9063793981f791857f0ba207277b14423c9c78bddf0ce3b7a2f63879e96f9df380f93c0b305713866bc4cd52a474e770dd48df1fcd12d4eca72ccc88cc07eff0deae924867cc031a5118969a9ee2b2309e3f27a42ed1192fb2db104982c0fb0d9ad78f790cccf57ef0c0b3b8c0d34f1802f3e61fd1d8f1bf5b2453bf28afba132f946a59493c17c2de3c91b5c1bef6b049158026fef11e22912cd77cb10c34a5a3eeb855ed4c773fccd5ca27552406c67cfd66c6ba36f0189a20aba4a0143dcc40878abedd13f58f66a0c92d2c38992c387f23efce7589c18602ca614394302b24151e481265c32f95f13873f0dbee43956b44c28ba445bd58759576fb39f87a5e1f79aa212dd6f00cd85cb47f9363f3e30eff75981cd943fd80e154dae6ee377edf5d60cfc6aec640438515dab461f5d5d5187e70d58f62200446430745a585e1d33d1082fd145bd2289f90707f1d5ac59a74c0b8775f0a1fac9c282a58469bfde257c93fe9cd5cf0c0c1254f37a027c29b61bcdae40810a3b48876fb1c0833a70c2c30ed6c32f465391ac0c82492919bcfe4937d4f80778702234574e65d7b0a7c480e47c4a573f4dfce038c9017c9554f1ecddb1ee7957cf63e3ae88bd00710f76ca07969522a08d6640fdb2b3c03d1f0b9a370c39332715538039b3e13ef6b804a839040ce4123e8b229fa1471f9ca5ee9ffe731425bfd9d4e7434d62fedc1423c334785804eda3718b2a53b849de65249497d75bfcf2aa3311b19561cd004795df29167db429cbda487985cd4801c81d449c4d1f8a07fbb7899a2a12b3a62d4161fbef654572edd5b1ce7f53ec59a9709332b675f11750c3ec80e6d0e4c38239f93497b6d9526699c4f4a78272c807a0297a63582d8df373f665e53547d4417566260f02f431fd8eec8bfdfcb0aa5cf6983e517dc04b4ff6402f6259e878ffcddbd1ce4375364b9d920e612888256b4a5cba58f406c5c9db13a1333aa01dcf2f417e92382830752242f107899548f6d3f5a7cb9132264aae2729fb40c176b56cc1eddf199a4a0d09c290bc890877ab6c0ce489d856e4fa1316be6c0f9504203a1ebc3766f068dda77754b486433e56718762b7b7db693112942bf71c1d6bd0aab741aae776694551a3b5f68aa03821e5365f09f5ff2bea3e1d03f103d206133339ef51cdb8e5c1a7c660b96e5313ba2897bde97d6cfd215260592c255e0ae567805d1046761f8a15d1f487cad0d7b674142972d23ac34f2fb0b599272248e5bbe10a16c40ade7230593c5169db3846b06cebbb776fd5f2aae7b156ac7714c117d22be1eda96472c3dff27a3d8062cd90cc891da12909f4bc13967912b54f4496e1f7c1190bb84e2101e20559e3e8b307257f32308ef5da47cace80da7981fde49914ee29272e6b85fdbf2b51292851e544a1455e9b871026965413203cfd2baaf0ac4e7185cf698be26d144192ab72785a6614d8bcf3b455f432e8c903e663b7d616bf81b07304cc2428ddc63e48ce23cc538222bdf988fd963702261a8be7beed1466608863b76e22698b93a2df29f239ec634edd3c3d6d64b33671887ac435c25045390045d19d864ece9a4250bbdb64ddf9353ac0f0ced697a8c4286b1dd18bca7aa72fd8f7f0a5