Pjblog Cross-Site vulnerability exploitation and repair

DEMO code for Cross-Site vulnerabilities:

[font=expression(container.document.write(unescape('%3Ciframe%20src%3D%27http%3A//www.godx.cn%27%3E%3C/iframe%3E')))]God[/font]

Countermeasure... Shield keywords

If you do not need to block keywords, use the following method to fix the vulnerability:

Use NotePad to open guestbook. asp

Search

The following is a code snippet: <% = Ubbcode (htmlencode (guestdb ("book_content"), 0, gbset. getkeyvalue ("ubbcode"), gbset. getkeyvalue ("imgcode"), gbset. getkeyvalue ("autourl"), 1) %>

 

Change

The following is a code snippet:<% = Checkstr (ubbcode (htmlencode (guestdb ("book_content"), 0, gbset. getkeyvalue ("ubbcode"), gbset. getkeyvalue ("imgcode"), gbset. getkeyvalue ("autourl"), 1) %>

Similarly
Cls_article.asp

The following is a code snippet.: <% = Ubbcode (htmlencode (blog_commcontent), commarr (4, pcount), blog_commubb, blog_commimg, commarr (7, pcount), commarr (9, pcount) %>

Change

The following is a code snippet: <% = Checkstr (ubbcode (htmlencode (blog_commcontent), commarr (4, pcount), blog_commubb, blog_commimg, commarr (7, pcount), commarr (9, pcount) %>