ECSHOP 2.7.2 Release0604 Cross-Site Scripting Vulnerability Management permission and repair

 

Brief description: The Tag Cloud function is not strictly filtered. As a result, members can enter cross-site JS Script Reference on any product details page. The background Administrator account is leaked.

Detailed description:

 

 

Vulnerability proof: External test. js file content. Allows you to modify the username and retrieve the password mailbox of the Administrator account in the background.

 

The background administrator browses the page source code for Tag Cloud management. JS running

 

 

Solution: filter the PHP script here.

Www.2cto.com note: the official website has been fixed. Please upgrade it in time

Author sfcuboy