Silverstripe

啥也不说了、、、睡觉。一切后果与本站无关。

1. Silverstripe CMS, <http://silverstripe.org/>, version 2.3.4 and lower
   
2. (and its unreleased 2.4 branch), is vulnerable to two Cross Site
   
3. Scripting issues.
   
4. 
   
5. 1. The comment posting mechanism of Silverstripe ('PostCommentForm')
   
6. fails to properly sanitize the 'CommenterURL' parameter. This allows for
   
7. persistent injection of HTML or javascript code within existing HTML tags.
   
8. 
   
9. 2. The forum module is vulnerable to a reflective XSS issue caused by
   
10. the search script failing to properly sanitize input to the 'Search'
    
11. parameter. When invoking this URL:
    
12. SILVERSTRIPESITE/forums/search/?Search=%22%20onmouseover=%22javascript:alert%280%29;%22
    
13. trying to reorder the search results will trigger execution of the
    
14. injected javascript code.
    
15. 
    
16. // 51gho.com [2010-01-27]
    

复制代码

有啥用？？？