94KK Forum cross-site Vulnerability

Refer to www.2cto.com

Extraordinary operation speed
The 94KK forum system adopts the server cache mechanism and is developed in a three-tier mode. It carefully and rigorously writes algorithms. Compared with other forums, the same database capacity provides the fastest execution speed for 94KK. As the name suggests, therefore, "94kk" is also called "quick ".

Safe and reliable forum
94KK always puts security first, and performs strict debugging on every code. It provides the unique 94kk security shield function. Forum logs fully record the power strikes and Forum Management, this allows you to know the running status of the forum at any time.

Practical and easy-to-use Forum
As a webmaster, you need to have a fully functional forum, but you do not need a complicated forum, and you do not need a forum that is at a loss when you log on to the background and do not know how to manage it. The user-friendly design of 94kk has always been the ultimate goal of 94KK. Some unused features won't appear on 94kk for speed efficiency.

The above is what the official website says

It seems very powerful. I am not sure if it is true to strictly debug every code.

Recently, XSS vulnerabilities are very popular. There are related articles everywhere. Let's look for XSS in this forum program.

I downloaded a set of programs and uploaded them to the space. After reading the Forum design, it was quite good. First, I went to a forum and posted a post. I tested a few places, but I couldn't insert code. Finally, I tried inserting images and found the XSS vulnerability.

<Script> alert (XSS); </script> it cannot run at all, but when we insert

<Marquee> <script> alert (XSS); </script> you can run the script. This program only detects the file header.

<Script> and other common characters are filtered by the Administrator. You only need to replace them with other characters at the beginning.

For example:
</Title> <script> alert (/xss/) </script>
</Aaaaa> <script> alert (/xss/) </script>

These operations can be successfully run. How can this problem be solved? Although strict debugging is performed on every code, there is always a limit on hundreds of secrets?
It's such an inconspicuous starting character that triggers a bloody attack.