XSS vulnerability in the search box on the 19th floor

Vulnerability Author: lupin

Submission time: Public time:

Vulnerability Type: hazards caused by XSS attacks

Level: Medium Vulnerability

Status: confirmed by the vendor

 

--------------------------------------------------------------------------------
Vulnerability details Brief Description: the search box contains cross-site
Detailed Description: the search box is not strictly filtered. <and> but not filtered. "attackers can use the tags of the web page to perform XSS attacks.
Vulnerability proof: search content: "onFocus =" alert (across sites on the 19th floor)

 

Solution: strictly Filter