{"action":"opened","issue":{"url":"https://api.github.com/repos/doramart/DoraCMS/issues/136","repository_url":"https://api.github.com/repos/doramart/DoraCMS","labels_url":"https://api.github.com/repos/doramart/DoraCMS/issues/136/labels{/name}","comments_url":"https://api.github.com/repos/doramart/DoraCMS/issues/136/comments","events_url":"https://api.github.com/repos/doramart/DoraCMS/issues/136/events","html_url":"https://github.com/doramart/DoraCMS/issues/136","id":315301167,"number":136,"title":"There is an XSS vulnerability here","user":{"login":"wfnetworks","id":38481405,"avatar_url":"https://avatars2.githubusercontent.com/u/38481405?v=4","gravatar_id":"","url":"https://api.github.com/users/wfnetworks","html_url":"https://github.com/wfnetworks","followers_url":"https://api.github.com/users/wfnetworks/followers","following_url":"https://api.github.com/users/wfnetworks/following{/other_user}","gists_url":"https://api.github.com/users/wfnetworks/gists{/gist_id}","starred_url":"https://api.github.com/users/wfnetworks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wfnetworks/subscriptions","organizations_url":"https://api.github.com/users/wfnetworks/orgs","repos_url":"https://api.github.com/users/wfnetworks/repos","events_url":"https://api.github.com/users/wfnetworks/events{/privacy}","received_events_url":"https://api.github.com/users/wfnetworks/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-18T01:56:08Z","updated_at":"2018-04-18T01:56:08Z","closed_at":null,"author_association":"NONE","body":"After logging in to individual users, go to https://www.html-js.cn/users/userAddContent\r\n\r\nInsert XSS payload in 摘要 and 详情, publish;\r\n![tougao-xss](https://user-images.githubusercontent.com/38481405/38907474-7a4b083a-42ee-11e8-8895-cbe4b192a753.png)\r\n\r\nThe POC request is:\r\n![tougao-xss-2](https://user-images.githubusercontent.com/38481405/38907446-5e9633ee-42ee-11e8-93c5-240ef37c2ac2.png)\r\n\r\nAt https://www.html-js.cn/users/userContents\r\nPop up a web page window\r\n![tougao-xss-222](https://user-images.githubusercontent.com/38481405/38907480-858f36da-42ee-11e8-962a-847f9920309a.png)\r\nLog in to the administrator demo account and go to the “This is test, please detele” edit. Click 'XSS' to pop up a web page\r\n![tougao-xss-3](https://user-images.githubusercontent.com/38481405/38907500-9697eb3e-42ee-11e8-9461-477d3dd38bbb.png)\r\n"}}
{"actor":{"display_login":"wfnetworks"}}