9158.com configuration error caused by two key locations XSS

First, an XSShttp: // my.9158.com/login_pass.aspx error occurs in my.9158.com (Account Application Server? Go = % 22% 20 onmouseover % 3 dprompt % 28947212% 29% 20bad % 3d % 22 there is only one reflection type (this exists when you move your mouse anywhere, not anywhere else !? If the configuration is incorrect, it is not filtered when the title of the personal homepage is set, but this is really new, because I have just tested that all the input of personal information has been escaped (can I break through it first, there are filtering instructions are configured) Why is the title of the personal homepage not filtered, configuration error http://home.9158.com/index.aspx? UserId = lxj616 is directly displayed on the homepage.



Solution:1. add the two parts 2. the entire security configuration is better integrated, and a single configuration is prone to problems, and it is not easy for a long time. your "first-class security defense software" seems to only filter parameters submitted by GET requests! I did not intercept the post test. You should check carefully and confirm that the new vulnerability has not been detected.