TDuckCloud/tduck-platform

XSS vulnerability caused by file upload(tduck-platform4.0)

Opened this issue · 2 comments

libaibaia commented
  1. upload code: https://github.com/TDuckCloud/tduck-platform/blob/master/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UploadFileController.java
    image
  • Create a test form system
    image
  1. After creating the form system, upload the HTML file, you can see that the request does not contain authentication information
    image
    image
    image
  2. Background preview data execution script
    image
0yingteam commented

这么快的么？我两周前也审计到了这个

0yingteam commented

从审计角度还有一个默认账号的高危漏洞