Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
wuzhicms v4.1.0 imgurl reflected xss vulnerability

A xss vulnerability was discovered in WUZHI CMS 4.1.0

There is a reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of /index.php?m=attachment&f=imagecut&v=init

Vulnerability file: coreframe/app/attachment/imagecut.php

    function init() {
		if(isset($GLOBALS['imgBase64'])) {
		} else {
			if(!empty($GLOBALS['imgurl'])) {
				$imgurl = urldecode($GLOBALS['imgurl']);
			include T('attachment','imagecut');


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.