catalogue
. 漏洞描述
. 漏洞触发条件
. 漏洞影响范围
. 漏洞代码分析
. 防御方法
. 攻防思考
1. 漏洞描述
Relevant Link:
http://www.freebuf.com/vuls/94277.html
2. 漏洞触发条件
0x1: POC
">alert(1);"@sucuri.net
3. 漏洞影响范围
4. 漏洞代码分析
app/design/adminhtml/default/default/template/sales/order/view/info.phtml
<!-- template会将getcustomeremail方法的返回值(即用户填入的邮箱地址)传递到管理面板上 -->
<tr>
<td class="label"><label><?php echo Mage::helper('sales')->__('Email') ?></label></td>
<td class="value"><a href="mailto:<?php echo $_order->getCustomerEmail() ?>"><strong><?php echo $_order->getCustomerEmail() ?></strong></a></td>
</tr>
5. 防御方法
app/design/adminhtml/default/default/template/sales/order/view/info.phtml
<tr>
<td class="label"><label><?php echo Mage::helper('sales')->__('Email') ?></label></td>
<!-- <td class="value"><a href="mailto:<?php echo $_order->getCustomerEmail() ?>"><strong><?php echo $_order->getCustomerEmail() ?></strong></a></td> -->
<td class="value"><a href="mailto:<?php echo htmlspecialchars($_order->getCustomerEmail()) ?>"><strong><?php echo htmlspecialchars($_order->getCustomerEmail()) ?></strong></a></td>
</tr>
6. 攻防思考
Copyright (c) 2016 Little5ann All rights reserved