Home Inn official website Home Inn interactive sharing suggestion Forum persistent XSS

Home Inn official website-Home Inn Interaction
Forum sharing suggestion Forum, posting new posts or comments, not transcoding submitted special characters, resulting in XSS, which can be used to steal cookie phishing, etc...
Url: http://www.homeinns.com/topicList.html #

Go to the Forum sharing suggestion module and post new posts or post comments on old posts,
</P> <script> alert ("XSS-Major") </script> <p>

When posting a new post, it is best not to insert XSS code into the title; otherwise, some posts cannot be browsed normally.

Or access

Http://www.homeinns.com/topiclist.html#the second page of a member account ..

Solution:

Escape the submitted characters