Unsanitized 500 error message causing reflective XSS

jflyfox / jfinal_cms

jfinal cms是一个java开发的功能强大的信息咨询网站，采用了简洁强大的JFinal作为web框架，模板引擎用的是beetl，数据库用mysql，前端bootstrap框架。支持oauth2认证、帐号注册、密码加密、评论及回复，消息提示，网站访问量统计，文章评论数和浏览量统计，回复管理，支持权限管理。后台模块包含：栏目管理，栏目公告，栏目滚动图片，文章管理，回复管理，意见反馈，我的相册，相册管理，图片管理，专辑管理、视频管理、缓存更新，友情链接，访问统计，联系人管理，模板管理，组织机构管理，用户管理，角色管理，菜单管理，数据字典管理。

http://mtg.jflyfox.com/

Apache License 2.0

626 stars 286 forks source link

Unsanitized 500 error message causing reflective XSS #9

Closed ztz472947849 closed 5 years ago

ztz472947849 commented 5 years ago

Navigate to http://mtg.jflyfox.com/front/article/378''%3Csvg%3E%3Chtml%3E%3Cscript%3Ealert(1)%3Cbr%3E gives an alert() popup

There happens to be a few character limits in payload composing not by design (which indeed provides some sort of protection to it), <space>,+,%0d,%0a,<slash>,%2f won't be working in there. As everything was still in a url-encoded format and slashes were caught by routing mechanism in advance causing a 404.

Tested on Microsoft Edge 42.17134.1.0.

zcool321 commented 5 years ago

已解决，下一版本发布