DedeCMS 5.7 XSS cross-site WebShell and repair solution

 

Brief description: The description of the circle is not filtered when the circle is created or edited. You can insert external JS file references. The administrator can seek help when viewing the background circle list. Run the external JS file to modify the site configuration. Allows you to upload php and asp files.

Detailed description:

 

 

External JS File Content

 

Proof of vulnerability:

 

 

 

Solution:

 

Filter PHP code here

 

 

Author sfcuboy