XSS vulnerability in the school edition e-schoolbag Teaching Platform

XSS vulnerability in the school edition e-schoolbag Teaching Platform

I saw the http://www.bkjia.com/Article/201409/334988.html, too.
Stored xss

Detailed description:

Use the official demo for testing

Http://demo.31390.com: 8080/eLearning/user.html



Click a user at will

Write xss statement in the message
 

Click to leave a message.

You can play it directly ..
 

Look at the source code

No Filtering
 

Test address: http://demo.31390.com: 8080/eLearning/message/s800.html

In fact, it is an html file, which gives xss a lot of space.



Test Universality





Http://ssd3.31390.com/eLearning/user.html


 

Http://jhxx.mhedu.sh.cn/eLearning/user.html


 

Solution:

Filter ..