XSS risks exist after a substation on the 19th floor does not strictly filter js Reconstruction

 

Brief description: filtering is not strict. Although XSS is not directly caused, re-constructing the js region may cause XSS!

For more information, see test on Jiaxing station! Other sub-stations did not look at it. When posting in the 'talking short' post, there will be a 'description' input box after the attachment is uploaded. This output is not strictly filtered. After the input </script> forces the js domain to end, as a result, it cannot be edited again.

 

 

 

 

 

Proof of vulnerability:

 

 

 

 

 

 

 

Although it will not run on the page. However, malicious code is displayed normally in the js running domain.

 

 

 

 

 

We first shield the js Code behind it, and then fill in the code in the 'code-filling region' to change the original program structure and run properly, this may lead to xss (if you are interested, you can test the CAPTCHA complement Construction by yourself)

 

 

Oh! There is another small problem. The java exception is not good,

 

 

 

Author shine @ wooyun