安全研究
Explore CMS v1.1 反射 XSS：当社区型 CMS 的 UserID 字段成为攻击入口
Thinking
2025-05-15
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全#XSS#反射型XSS#CMS
Explore CMS v1.1 的 user/login.php 与 admin/login.php 端点对 UserID 字段完全不做 sanitize / validation——攻击者构造最简单的 <script>alert(1)</script> payload 就能触发反射型 XSS，盗取 session、cookies、邮箱内容，对社区型 CMS 用户尤其危险。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e417a27d9d0b99e3718f8ac9a6c690217e6e3a038e81f0d76c76c0d9387395ec8a8e967a55676260c6c76883bedc4855d961f162c4dbf529a838110e12ec1f90a1a0ad0347b66c14ce303322f82a54100644c64833309a8cad788a982fc35c977a47ffc0985fff8983cca5a78ed2da65c4739600e7c749e95a7e6509d8a829b4db3b92a6432c7b3097160f7e01be768272f877d926e958be0fa3badc7ddd1485895bf76f6417716822579a7ce0dd84752b27e0068594164473aa0ea89dafd7ff6978d1c671b566d9bcf95149578099733f8b47d5a82402a5eebe16aee55f2b67d7e96448e9b320a43c3bf740dac0265cf4a98a727c671efef4d245b93462bedb8a9c0f3ea7f03797d7b29c18189d6302873cc9120332d831217a791cef0d52ff57ef4836cbe9bfca41369d0d6482912df03e58a5f0d13feb9c6881a1df635311fdde2553ecf39c60a7a81eb93b9b0c6681a69148fe8e9d383ab185323eec47f8631efdc714612f2d2c63b282664845ded31dafe1632d79a68a3ba3ac3a8da5b4e99d801367bda988c8f2d0e29292976758e6fd01ebad5d03affa583107219f0c9a7fb9d867a5e23ec2823bdd68c68e645e9e939d020d7918c7cd6ac4c49f4e026c9b7db90530600c71fba7484f31a90981e8e03f408c2cdb8468a3b3762f4b7b0eb2ba8bbed6c4f3cef765c81140b30f607015e2efad900f62c7e642e44407f7d2818b3d2896591a35439ad6938fd7e94beb1a8159ac77a8539f113f7852e2ca12a304f5e970b3787ec460c8521276d5b8339774bd8f21ec5d027ff6016bf7df7fedd36573b5d358e7f390e543bef86bfe65b65a4e892a67f60753f4c8eac6b041eb7640ab1997c3752b3a33344d1ba279c44b0e9717655c374cfa44e36fd714fcc7f8e1a86d4d1c35386a1f42ca54aba97c92d88829c0ce6df19710c3e5f9a8ea6d5320b0ab77c655b1da03549a78ceaa2f42c153b6bcebbd796029fbc6712d646c79a78618dc19c4082fbfa6e42e6075cb56f637c70e8eb897abb9ea0e4aee943139af4c1226fecf94e7ac2908f95f4df4686f2e65b18220ea13b33e963ce6fd4f16148b94245e0e4857b39001fcef45501bd1b3d92e0f3491ffbca1a5994a592310ee7598cdfb1e68526b94e14a01d9ce2c99f5f6393aa4f606a790aed8890776986e09915754943a6c04711795e3e242e711c0d51760f19923edd9c7d2498b5c7528e1fac5938931068dc10dca5cee9e30641609ab2a40294857a401c946e1b6cfe5dc622233658426f635310c4d53abda44c1c07424592a3b07b1f599007ce1450823ff97bd89c9dc4e1617609cb2fddb6947a3b5970bff4d6097a5dfb2c31b201dc56d57f64ba15220a36b0c57b0ac6d8a82a5e48404076268c20b2e67efa400c03ffda1a705563452a2b349ddb937565c31105a4218baaaaf2ea00ba73edaecf07ff083394353a2e89360d65f5c3c779d61e6f9831502d379d0b73f7fb02a306b6ae0d48fbfa293af31fa82979315bec563e7cbcfbc7b4cd369d5eaba6ce7d546d34266bee10047d9bf23aa8e88a58307bd2455a47a8667173a4f049ab77e2e00305bf5bc5c4178b964bd5b6b71033cbc673bcf8e9384a873daf9a1337c58301c49b596cddc842de1cbfad6f05df18ac781f319c358155996ebe5f2bb9cbd792aaead9fcf47fde2caa08ed6e87fe1e2bb5a5d166642db464543373bf7790c28e524cb11b34a5aa6e221620401b14710f54d20f503bc3980f1a77defb39086ca17cc1985446ad47c64473ec56a6a966cd67155f4bc4e78110b3634a521b7d55688faf0c326ef34d29177b6ab9a4cd04602c6469941ed92d09e75eb2b30402574eaf7387cfcc529e853d28c19ac0926c15ae6f9d9f98c263609f8927c01638a31de385c032df5d5734a5523c0b9f1fef378940706adf6335ffcfc1eb42d3c0171313bae5ddb4a9d9759f3a8f245a99dc55fc20effc5689080059f8ae9e2bcf413e4043293786d7f44c02502d0c7009eb763f998c889d426953f570b9a4aab271d2f65504d8ed73a88bf98678b6cbb98714142e6790c1d50ced8c714bb7ecffc396e16a91ebf420cf51e77f37a165b09aec0a50e154fac027385553589c6256766ef40294bc09461419be57eece42d9a73592f2ca0f6cd5aa94690e488a09a7718fd39f340f9a59cf2b4f59719b4ad03f57f17a69014e89dd9294e666e220dbeb2e3cd9ef5e470463abc6c88ac175bfd67e6a7e2733e6665fe4f33e66c828bc1aa4586dde9eb92a8a623abc5d9a7ff2687a30eb0fc1001d83de8e8484375debc0182e1ca24c557691995d80edcba4d4c621be2a44493c9c216437ed75f311382264df81d4551bf6fdd8c8ed1f3913697fbc19678e54e36b0f009a51dd7ef7fef6db51c1aa32b4ad644326a77f809cefe3b31cac5cbbb2e80cffb186da08d270bce7fa04463dfa78f2c6b00fa16b423eeca04005da6c7edb2259398fa6cbb28a60409b1d820cfa669b84df57af5cc8241c7a1ebb0cbd80fa61dbfb017dc6d7eb3570b1a171868c9e8909171bb3569e5675c3601341342374e9d0f4d570aab6606bd4a42e96895157b3d7e646a9db7d783e8b9e021552bcb3ea47ca497d4425453bbf9d61a7058f7df2434cb625d4ff649dd2d3cbe51723ae83156f92fb0271692d84653f2c26ff77ccceac0b7b135e30a3de0045b99d13fd5ae71fb06978035b924c99b85f5fd076269dba09127c9178713eda210396e885f16fadcd3ba8e1218d809dcdd8554c72f5819a0206b0512bdb69c2a71ccff183fb261a8233539e0418768852c402f30a5bcf769c3471902b83789cfe87862fdc46602e96571be48a7beec41505a143fb67829c3b8b22bea29a4847d9ff59a6b9f5143a7d9c3bf04b9624a2e7651458a21154bd6b1d9fbbdc557411f44cd7bd2d55dbdc80c3ca808ac72e4758fd38652c73fdc2af50b64a8b11aa892b2d0e1fccbc754cb255ded3c7bbb9c685b598c33c7745a73d2cd3808271863eee46b00ebfd772fcbd90c771227b5c5dec447d19c592c4012ad981a2148503255f8228f080785398b42799492348c68910f055eac7a58313614d3533e7c0db362c95490fd702cd03b70b27407ea79a7bcc4df2d7f9dc444cc4920a7f2c7f4f92a1d6567b98b13d47da5f270c429ccedfbb582e3c15ae413f4cec5a37c9fabd774680a54dae51b5710b2703a363b97a55274895b42a6f992477636c9a4657d5cac0560ff81bf6413aec61339a527c50b080520ebb8fcddb37211755c017eaab396b9a9423ca132041ea1974274d4477403d210bf454158af35723a1b8e0c5bdd2ef973824356b2f29feb2d36d11403a921c7770e45894aefc32a6c6eed6e13c083c6e11dc74f2aa81c47aae9b9cf51ba6863663d0c72d4928b7f433c12e0e2d428d1b9b860cd71e8b75ae4fa8c104b7930450073da0a3dc44d2344c31ff00c16c066b91b6bf9b35858a7e8b52c2b67007d642fd8cc9ed73088ea2e84815410eeaa4da9446540ad66d2e656b507163f158b1c8cc70349d966e7fd02a4d07223dc14539962072ada50d2a203a004770a1866fb48e4bed50216acaea842b64af9d1c360473e1a8cf1907303fd095bb8b08c8bdcaf9b130ec7cd555240a4ee98fe2af2b63aacfbcea678ea6afb1b76fbb0d1030117fddd203b2ca2e591ffcda98626e077f39e6264a335430ed33d05a2e4a65ddbd4b39cd6d4a8081691df19d20d23a481502395492bdbc720399093570078044e5812f2ee729b2f9be4b8861cc996e2ad71a820650c0a44883dd724f047c3f3f0fea10d0502a87d7881acf596d760b4e44e0b545a40dc1b06a1240a024d0ff6b5453f5e7370b492b4580026d4dad6a163a0738d133cddecd4ed3948c5ec510a7c46404e2f621b7533e5fc61888ad92d0b3a3313078838aec0dc8fde093cb2d43d6c1814e7451cc44a7543d0d299b35f19ab65907e3792583125c358cf344735d268c72351a6e1c76c7415d53aef84bfc4be524fa9477a436af847f19a08ac7b549410808b68fe71d6e488dfd27b4e154d890fb75d45e710d71c48bacc0aba14b4c51f6407515dce51d8dcad41d8afbd500f9630ccde487ccd6a985bea21da4a4beb03bfa68efbb5ea59969656752c3b764693929e72a04a372aed313c633e189a707ff8e4ef067cca8d90cd2761adb2c029a7492af97c4a2a1be9287886e551d990c397a0a3c67b40b017ba9414e5edaf1f348655da1e60e05961813ce6d818541109755f19b06df1e5f7f0a142ad528dcfe4317db13e86f330607df470f35a7f98ad3133fc338f62c8c1be1a0e14303d516e4fc0d4cab2bf998a6dfd42b365a40eaf242d29f59e9a8d8e7830b96d11c00d4172bab903b0060837d0e04d8449b9ef693f383a5353a0c9e8179a6585b006e7705391f4e3eb07203cfdb29e5833d96603ff27927417777b011a3cd9ea681e3f649e5c4cea8a733b13734cf81eaa7bda2e12ff945c9924eb5b574744fa40e297abccd4ee690fa8e93b69350a7d62000f84f8f521a2ca03e01f98de3801d485696728a27b34c8c98e5334297cedda73eaab8e37e4cf7e0cf8432b6956b882d23a107408125b58251332a2e9041612a13b698c90eead05e84b440878e7f1aa6e740f50d5a31618f34ff0059926a3031c01326510fdfce12d591b5f3bfc51e3f48d4326a7d7de7d7ca903e70f7d604c30a2d1d7c70e35b25ef5247cf25e2ada76b4038b0a6f53476653baeb9da3775fd372ed15a16391e22dcf0d76a8deb0baf035e21bbf912adad61e26ace4c403459a5dab790b95159b7039eff03ab4c709080c78e5a09ebdb12f8564680e4cbbbf4957347620cbef1f1feb25a10e69aa04716020f238a4cc8f4427103dab4d0fefe344bc672c2ff8cc24afe01ffc82b897f25be023bc007d9ee2b0114e1fe544bcd0b0218c6c921a511489ad8e76dbf06708531f0417a0206bedf3b14f3ca68cc3f8d2ef8b15236f58cf6a637c88250463708fbfc687e1a7310279be916e14f33f2519e207bbe63b6ce0f8c3732aac255ab855560cc4f9975696a6257f1d67263a36e0584993cb8601c4ff4d40b74a9e6f03fb502a28a106fcda2b5c09ff6f78ddf2d26751617f37308cd8c588bd8bb9ba1b1c81ddae86fa1d1152ca58c24a9d8906f1f5507bec3ae6c1c7371b2aa94be1c89e2c222405aef6af3c9b2e80e658a7e83fa77952278f70d349d6e939eef847eb83fef98632c62e3270a2d0142f68028c63e876b195f61376a292f177ebd1678967ac2b95470f1e33e2373b737ea0bb970f39ec2c8eb9baabe4abcc20a7dbccb90c3fd0d2d0f9730b55b5674f9910240c338c2b494178221203fd59f01ab252174809461ddf91e4db7c84a7b1cb4b94c4e2db9d59044605e16d1b599ca8ece71624a305ad20fae87bdce42c8422462143bd7f30a8204143f7989aac8fc0fc4918e3c4c2fa7c515732039f9fadf62a6cca7f98dd7d46af13039b66475ef338dde8617d5b41dc8186df03b9aa9efbed3204f76e18becc517106cf6dc467ccb75390d58f6a96d85b59b0fa03e87a20a26d75df0ffa520d7487af43fdfce7f70eeddab73e32c58b1f582c566ee5ed5c17db9835acd167a550ddaa97406c5c59e096ea9e0e8223c266e84d925832fde66bc4fe143c4b4542877334e3c495ac76ac02bd8bc0d7287c8feb68c7dcb05b22e2e2e4579cefe2aec7ae26a48884965776a0206e526fe9fea81bab7f1a971fddc6d5661db0e42ee0f3f7e0ba162f395918fc35e682312cbfd0f652df00d347f63f375bb8a1746db22a83208851ffa289bcd5abee2869999d628ee510af13c50285d57108a5f29aa2264fd5bd87f9267daf7db46db115b56bad7f9dd07479d2126e5c2d119650fd1d074af9a25fbb5c7c313e6eb2a961030b09d25218fbe89880eba5f2a7088bbd462b804f7530192a0e3d06000abd2c2d55061735045b4d076b18cfe3250f5329c93841eec40ffdebbc576da1c446b2d67daad4c9f0112b839cf97608eb211a5d4a0f947595a768664cf28112c0a33cc4aca93e9e2bd8fbb11622be930da26c6e04d254389f5ef6eb9c03c1bea101ab9efcff88ae10e5819aa846157ade60f3d3d495fd67f959218bbd000d92b74b5c4538aa8787a0f95a6d483da967cfb9c0f10d4e75c7bd5560ce7e991a4004be3414c46dd762ccd5c24f4d4e8adcf192d19cb231c49309514738ad118af6e16481e88716a9cdf252377e770ad4a46898f3c2c964a062700eb2894dd6ab199173ab10545a589b3712c9b975af2cd2b370651d64f6582d45ebe7ad29e3ef3f69617b569eb71ee24bdb521a44e3fd303d0a19199e30fae96f64121f6c15d1954da11822e435cc4f6af8f8a029c19e89d69983e766ab123524fa717b131b9c3d5eea04d275ceb2015b5d85763c49cda140e8528525b0935c63854fadb00b9ffbdd2c3dacfc4daef3106d787c8cb5440875d34d40770e00d99f0115b3f151f52ff81c850216e1697983488ca9df17c385beeed987ef671664067a32a928ae1fc02b6b93b32ddd2334000f76c950881cfc50eb5ebc69d27948731c3e7cff82a6984e4b9405ed70fafd3b348de9519c68a50b7dacea57c2a044ff11cf8fb3cae2d5f3588397a7a1071adda7a615ec901fd2613e46641c29a689d51a48e0f01e2e79067887edfd669237062cdec246ecf50483649c93940bb6ecc79baf157ae624a30c76e34d07e4f531163016b8f6d38572bb62b32d47f318408d083cba56e72a92eb00222ce42a7a16a033c39547a71971e3ddfc34257fb48f174de89366d4ea10bce2db60e023b902d31a1869e3423a2bb96888f741a1f2b37d86303b96c7ed4ad1e97df87d94d7fc05a361baecdcb17f20f05b0dc2384ce29a43c8cca902b3e87295e435e59a1f9bebe2b256cf291f451bff97283416b01c208745e462855dbacddbfbdb1592ca97603fc6ad26edfb7c182027662bf9a9e680c52a61f223c692c21e7bfd8f784ef5563ff02dd1cca689bbf0b1022d5772d1002653831c4606bf47d04af6f1b2c68fe40e857cc8665cc3d8e19bee05cb6f079da741fc581e00eaee55b161ab3a24010e93b100e3df410758204d16ba15bf7a3b5594e68334cd0829cec8ef99e13d8d2d082c7d677803f449b4f86202416e723a9d04cca67ceeeda02a87ba164178550a4ffbd1ae2bb4646cc50cd7fd5a9bf6886bb8a4ce1d1a1998424394667bb19c5f88f9d1671da15be66d9851da57b90514c8164b784530a6565f199dae45cc10750a80e8d4c47809f7ca97f989cf15d03f08a9d8bd3e9610202b3f9ff436ec24d58a8ee1cce0e2ce5424cca7c6d990d9b3c666622fb9d8e1e318889e1a7c24a188f94230513931ff55547797757b0b0ed449feb7f76b4dcab626f345434539d72e818c582b3b95c6f006bfcd5870856d9e84161960d8bf549d78b01daf39e3ad442b49352b62f29d4a860f4330c4a3a9606f9dc1f0fea5fb305064a45cab6e7233d58f8e64207ab73152357840ad7fdba594422dcc09d84db5df0b2d65d245f88394d3baa3065f84a88933dd03c02012a2f162e90e26f8df9b7ee7ce2db5f4cb1b8444aafffb8cfc7557bfbd80fa7e005c5c505d3620db57b5380f6db85e02294e31afb33046c27b051248dfc99f92881b55df967b703bd75cb7c15db2428030c7ed2e1c518808f519212593e7ab993348bb8ab659bde156fed092768c82b1acef023a52d7c6c1a8dc0bbdb8e9ebc96c8691947815427ede806b4be883dbe6219d337c0c0033e60cb15aa2274faf8b0b6f3bb6d34a14228070d4d39413460f2c39c35829dae53b9ce23c9357927ddfcff51b49bafc50f3c77137c2998ed3261c6f135fe038d74201eaea1ee3ea0bd2df55aaf3c8f5b90c0463978fe16fd01233cad4f4947eba2a4451422fd6a25dc0ec1bb79df12ab7742c7b0dfb9239020947061e13debd2d79daf9ff0257b60c4b3af69f2ae89b72f039dd24d35139f64e27e6edf60a2ecbabb9bfbc2e92bba2f145afbd4d7a050234237b82d7f78437b7040a046aef7c208d5844d9c0c53ecb82e99824f254eb574bc4b7e2106d024ea02186a19a018ac6acb0cb3e0106524ee5bfe3933eb7ab8336e405d6a190452016d06dd97bf545268782caf5ea1f465bb81013d1e1d14e756a3558930023131ce74e4621b781ad9252e2eb71237c94665e5908799a13190d0061b00ed6230c3d3776aba0e8f35a8e277ba1b566d36233574b6358dc0e4cc8e19da0e66c6802b88721140f7279e0a7e31345bec01e89856de6187de478c19f90b6dac36a88109832795d264df8bed525c9194702ebfe716847cd6b5101bd2d5664de37cd7226e681e798a300acc0fcc16a95159f0f6176202c3289dfe7086eb2c6aa9051c7dbd203bc840047752b7ea5ee3e0b8dcab5ea718b1126e26e6bcf81d0b0c6d931c3ceeadd831a9e3164e5cf72da598b02ceda4f731cfce0e4bafc74b7d019db21c8079bae390cee470086bf3028ca2c8c083a5f364103b6b2ce5ce95ca1f0e2d3e2ea5ef32a32fd6ba9d73141485085993c3bf744316f613ed57e1b479061b1eb7f6f76f652a397adda26e69b6e9a49e9c098cdb01898697c24e5cf5edee8820647933b5716d7f2009654415ec94a8a72a27b011910e9b705dec9cc1bbb42bc35c775c335bbf59d4ed4a6fce840dbfa9f956f22d11561e606e376a6c4ed0f1d227677be2b1f493afeffc398c307f4a315d10e26fa77787fed5f85238276ecc03912f031a4dc34b93ddfc0466b1eebc68fc7806b38c5d60166f88544906652411da504ecfb7b773a5443ce95748387a34d4f1134af7d57ea858daf9153c9f90e8690c45319e0dabb227a674dc2c4c392bf87bb5c4e58e61a544d0c81a6249984285b62bdaa8d201bdd8e033384d613805da236864943ee724690199764702526314279cd30834276f450d638be8285d08d6e1e39cd5c33561a08269300c1aaab29783a9aff34a0b420635c3175ebb8790357eacd2566fc6e6d0a791eb8c1618f8a0950e880376d990e9b4ca2f4e2fcc0d2b9778e627e03d6cf7942d7b893edfa08cb4ef0e86ed80d71e5aaef1949672d4794c28af91ceaf01f99054d6213fe50ec3c0c0ada4e2c65e495cb09e74