https://blog.1sec.day/tags/%E5%8F%8D%E5%B0%84%E5%9E%8Bxss/ Recent content in 反射型XSS on 思安录 | Thinking's Security Notes Hugo -- gohugo.io zh-cn Thinking Thinking Thu, 15 May 2025 00:00:00 +0000 https://blog.1sec.day/posts/2025-05-15-zero-day-explore-cms-xss/ Thu, 15 May 2025 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2025-05-15-zero-day-explore-cms-xss/ <p>Explore CMS v1.1 的 <code>user/login.php</code> 与 <code>admin/login.php</code> 端点对 <code>UserID</code> 字段完全不做 sanitize / validation——攻击者构造最简单的 <code>&lt;script&gt;alert(1)&lt;/script&gt;</code> payload 就能触发反射型 XSS，盗取 session、cookies、邮箱内容，对社区型 CMS 用户尤其危险。</p>