A DOM-based Cross-Site Scripting (XSS) vulnerability exists on line 1 of papers.php. The application dynamically includes unsanitized user-supplied input ($_GET["id"]) into the JavaScript context of an onclick attribute. An attacker can exploit this flaw by crafting a malicious URL that injects arbitrary JavaScript, which is then executed in the context of a user's browser. This vulnerability allows attackers to steal cookies, hijack user sessions, access local storage, or perform other malicious actions on behalf of the user.
Vulnerable code: AddHRAD('[试卷厅]橙鸭笔记系统V2','试卷厅_橙鸭笔记系统[首页]',' href="javascript:void(0);" onclick="changepage(\'odback\',localStorage.ON_LastPath + \'#notee_'.$_GET["id"].'\');"',"","");?>
POC: http://[DOMAIN]/OrdylanNote-main/papers.php?id=%22%3E%3Cscript%3Ealert(%27DOM%20XSS%27)%3C/script%3E
A DOM-based Cross-Site Scripting (XSS) vulnerability exists on line 1 of papers.php. The application dynamically includes unsanitized user-supplied input ($_GET["id"]) into the JavaScript context of an onclick attribute. An attacker can exploit this flaw by crafting a malicious URL that injects arbitrary JavaScript, which is then executed in the context of a user's browser. This vulnerability allows attackers to steal cookies, hijack user sessions, access local storage, or perform other malicious actions on behalf of the user.
Vulnerable code: AddHRAD('[试卷厅]橙鸭笔记系统V2','试卷厅_橙鸭笔记系统[首页]',' href="javascript:void(0);" onclick="changepage(\'odback\',localStorage.ON_LastPath + \'#notee_'.$_GET["id"].'\');"',"","");?>
POC: http://[DOMAIN]/OrdylanNote-main/papers.php?id=%22%3E%3Cscript%3Ealert(%27DOM%20XSS%27)%3C/script%3E