Cool 6 network storage type XSS and repair solution

 

Brief description: The data storage wood is strictly filtered, and the output data wood is converted into HTML entities.

Storage-type XSS can cause XSS Worm. If the propagation speed is fast, it can affect users in a large area.

It even causes DDOS attacks on the server.

 

Detailed Description: capture a packet in the Account Management Office and modify nick to bypass JS Verification

 

 

 

 

 

 

The stored XSS will be generated in the header of the personal homepage and an external JS file will be introduced.

 

 

Proof of vulnerability: when a user accesses his/her personal homepage

 

 

 

 

 

Solution: You are more professional than me...

 

 

From Mason @ wooyun