项目链接

Lissy93/dashy: 🚀 A self-hostable personal dashboard built for you. Includes status-checking, widgets, themes, icon packs, a UI editor and tons more! (github.com)

影响版本

2.1.1 Docker

漏洞过程

找到一个禁止前台修改配置的dashy站点

构造请求，发送，服务端响应配置成功

修改请求内容，使站点的标题改变

最终发现站点标题修改成功