XSS and a reflective xss

When I saw a blog, I suddenly liked its concise and fresh style. Of course, my favorite things are always expected to be better, so it took some time to perform a simple xss test. I hope to make the test better.


The vulnerability trigger point is in the "blog Settings" function of the blog. First, enable the blog settings and enter in the blog introduction box.
 
 
, Click Save settings, and return to the personal blog homepage. Step 2, click the blog settings function again, and the following will pop up:
 
 
Third, this function module also has an xss vulnerability, location
 


 
The test method is the same as that of the first and second.

Solution:

The vulnerability is generated mainly because you are not aware of the anti-filter of the <textarea> </textarea> label. The factory can filter the vulnerability.

Author: wanglaojiu


The formKey is not required when the application form is submitted. In the response after the form is submitted, the script tag can insert any content. So...

Here is the formform for uploading images at http://www.diandian.com/themes/new.
 
Proof of vulnerability:
Http://proofofconcept.sinaapp.com/diandian/xss1.html
Solution:
Add a token to the form and check for callback.
Author p. z