Old y Article Management System v3.0 build XSS vulnerability and repair

Version: Old y Article Management System v3.0 build

Keyword: Powered by laoy8! V3.0

Use the front-end, register an account to post an article (Management Review required), or use the built-in front-end management (no management review required ).
Administrator Account yyyy password 111111
Post an article and change http: // In the image address
Copy the javascript code: alert (document. cookie );

You can get the cookie. Here are some articles about the use of Baidu.
XSS is triggered to obtain cookie transfer during management review from the background.

Fix:

Filter