Mon, July 27, 2026

Code Audit — PHP XSS

1. XSS Vulnerability Basics

Cross-Site Scripting (XSS) is an attack where malicious scripts are injected into a trusted website. When other users visit the site, the script executes in their browser, enabling cookie theft, session hijacking, phishing, and more.

XSS is categorized by storage location:

  • Reflected XSS: the malicious script resides in request parameters; the server echoes it directly without storing it.
  • Stored XSS: the malicious script is persisted in a database or file and triggers on every page visit.
  • DOM-based XSS: a purely client-side vulnerability that never touches the server. PHP audits typically focus only on the first two types.
Older notes
Anno
2026
9 letters
Fri, July 17
Struts2漏洞合集

S2-067 File Upload Path Traversal Vulnerability (CVE-2024-53677)

Apache Struts2 is an open-source web application framework for Java EE, using MVC architecture. S2-067 is a variant of S2-066, resulting from an incomplete fix. S2-066 exploited case-sensitivity to overwrite filenames for directory traversal; S2-067 uses a different mechanism. In Struts2, parameter key names undergo OGNL expression evaluation. Although strict validation prevents RCE, expression evaluation still occurs. S2-67 exploits this to overwrite filenames during file upload, causing directory traversal. The exploit uses the OGNL expression `top.fileFileName` as part of a parameter key name, allowing path traversal to overwrite the filename and upload a JSP webshell outside the restricted directory.

Letter №23Read full note →
Fri, July 17
Struts2漏洞合集

S2-066 File Upload Path Traversal Vulnerability (CVE-2023-50164)

Apache Struts2 is a popular open-source framework for Java EE web applications, utilizing the MVC architecture. The S2-066 vulnerability is a path traversal flaw in its file upload functionality. Attackers can bypass the basename protection by capitalizing the first letter of the form field name (e.g., 'Upload' instead of 'upload') and providing a separate field with a path traversal payload (e.g., '../shell.jsp'). This allows files to be uploaded outside the intended directory. The vulnerability affects Struts2 2.5.32. Proof-of-concept involves uploading a JSP file to a restricted directory, then using the exploit to upload it elsewhere for execution.

Letter №22Read full note →
Fri, July 17
Struts2漏洞合集

S2-061 Remote Code Execution Vulnerability (CVE-2020-17530)

S2-061 bypasses the fix for S2-059 in Apache Struts2, which strengthened the OGNL expression sandbox. The vulnerability affects Struts versions 2.0.0 through 2.5.25. To reproduce, start a Struts2 2.5.25 environment and send a crafted packet to execute commands like 'id', with results displayed on the page.

Letter №21Read full note →
Fri, July 17
Struts2漏洞合集

S2-059 Remote Code Execution Vulnerability (CVE-2019-0230)

Apache Struts framework performs secondary parsing on certain tag attribute values (e.g., id), allowing attackers to inject OGNL expressions that are evaluated during attribute rendering, leading to OGNL expression injection and potential remote code execution. Affected versions: Struts 2.0.0 to 2.5.20. The vulnerability can be reproduced by accessing a URL with an encoded OGNL expression, such as `%{233*233}`, which gets evaluated. A proof-of-concept (PoC) bypassing the sandbox in Struts 2.5.16 enables system command execution. The provided Python script demonstrates the exploit, successfully executing `touch /tmp/success` on the target container.

Letter №20Read full note →
Fri, July 17
Struts2漏洞合集

S2-057 Remote Code Execution Vulnerability (CVE-2018-11776)

A remote code execution vulnerability exists in Apache Struts2 when alwaysSelectFullNamespace is true and the action element lacks a namespace or uses wildcards. In such cases, the namespace is derived from user-supplied URI and evaluated as an OGNL expression, leading to arbitrary command execution. Affected versions: Struts 2.3.34 and earlier, and Struts 2.5.16 and earlier. The vulnerability can be reproduced by sending a crafted request with an OGNL expression in the namespace, which is executed and reflected in the response headers.

Letter №19Read full note →
Fri, July 17
Struts2漏洞合集

S2-053: Remote Code Execution Vulnerability

This vulnerability affects Struts 2 versions 2.0.1 through 2.3.33 and 2.5 through 2.5.10. When using the Freemarker template engine, Struts2 allows OGNL expression parsing. User input is first parsed by Freemarker, then parsed again by OGNL, leading to arbitrary command execution. To reproduce, access the test environment at http://your-ip:8080/hello.action and submit a payload. Note that the payload must end with a newline character for successful execution.

Letter №18Read full note →
Fri, July 17
Struts2漏洞合集

S2-052 Remote Code Execution Vulnerability

The Struts2 REST plugin vulnerability (S2-052) affects versions 2.1.2 to 2.3.33 and 2.5 to 2.5.12. It allows remote code execution via XStream deserialization when the plugin processes XML content. By sending a request with an XML extension or Content-Type header, attackers can specify arbitrary class names in XML tags, leading to command execution. The fix in Struts 2.5.13 adds a deserialization whitelist, but may break existing functionality.

Letter №17Read full note →
Fri, July 17
Struts2漏洞合集

S2-048 Remote Code Execution Vulnerability

Apache Struts2 versions 2.0.0 to 2.3.32 are affected by a vulnerability (S2-048). The issue can be exploited in the showcase application by entering an OGNL expression in the 'Gangster Name' form field on the Integration/Struts 1 Integration page. A proof-of-concept using `${233*233}` demonstrates expression execution. A sandbox bypass method from S2-045 was adapted to create a working exploit that provides command execution results directly in the response. The S2-045 exploit can also be used with Burp.

Letter №16Read full note →
Fri, July 17
Struts2漏洞合集

S2-045 Remote Code Execution Vulnerability (CVE-2017-5638)

This document details the Struts2 S2-045 vulnerability affecting versions 2.3.5 to 2.3.31 and 2.5 to 2.5.10. It provides links to the official Apache advisory and other references. The vulnerability environment is set up using Struts2 2.3.30, accessible at http://your-ip:8080. Proof of concept involves sending a specific data packet to execute code, demonstrated by the successful execution of '233*233'.

Letter №15Read full note →