Headline
CVE-2021-46030: There are two stored XSS in JavaQuarkBBS · Issue #23 · ChinaLHR/JavaQuarkBBS
There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module.
【Vulnerability Description】
There is a Cross Site Scripting attack (XSS) vulnerability in the full version of JavaQuarkBBS. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module.
【Vulnerability Type】
Cross Site Scripting (XSS)
【Affected Version】
<=v2
【Vulnerability Verification】
Find the Background Label Management module, select the new location and enter
<script>alert(“标签管理名称”)<script>
<script>alert(“标签详情”)<script>
【Repair Suggestions】
Strict filtering of user input data