Cross-site Scripting vulnerability on the PHPCMS Error Report page

The Integrated Error Report page has a cross-site scripting vulnerability. Affected Version: PHPCMSALLVERSION: PHPCMS is a website content management system based on the PHP + Mysql architecture and is also an open-source PHP development platform. Phpcms is developed in modular mode and features are easy to use and easy to expand. It provides heavyweight website construction solutions for large and medium-sized websites.

Cross-site scripting vulnerability in the unified Error Report page

Affected Versions:
PHPCMS ALL VERSION
Program introduction:
PHPCMS is a PHP + Mysql-basedArchitectureThe website content management system is also an open source PHP development platform. Phpcms is developed in modular mode and features are easy to use and easy to expand. It provides heavyweight website construction solutions for large and medium-sized websites. Over the past three years, with the rich Web development and database experience accumulated by the Phpcms team for a long time and the brave innovation in pursuing the perfect design concept, Phpcms has been recognized by nearly 0.1 million websites, and is increasingly applied to large and medium-sized commercial websites.
Vulnerability Analysis:
/Error_report in the program.PhpThe page is not strictly filtered, leading to cross-site scripting attacks.
Vulnerability exploitation:
[XSS "> http://www.xiaoweio.cn/error_report/error_report.php? Title = 1 & contentid = 1 "> [XSS] <"
Solution:
Temporary solution:
Error_report.php

$ Info [''error _ link''] = htmLsPecialchars ($ info [''error _ link'']);

Vendor patch:
PHPCMS
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
Http://www.phpcms.cn/