YouDianCMS存在XSS攻击

YouDianCMS XSS vulnerability

YouDianCMS XSS vulnerability
First download youdiancms 9.4.0 to build a local test environment
http://www.youdiancms.com/soft.html

Successfully set up a local test environment

Need to log in to the administrator background first

The vulnerability is located at index.php/Admin/Config/basic website name

Failure to legally check the website name causes XSS vulnerabilities

Insert the XSS code in the site name, and then save

Then visit the front page of the website, the XSS code is executed!

Look at the code

The vulnerability code location is in the _save method of App/Lib/Model/Admin/ConfigModel.class.php

There is no security check on the information that needs to be saved, and no filtering