Bludit: XSS vulnerability in 'tags list' plugin , need 'Blog X' theme to be active

[zongdeiqianxing]

1 open http://10.150.10.170/admin/edit-content/follow-bludit
Visits

2 open http://10.150.10.170/follow-bludit

[clickwork-git]

No vulnerability. You must have admin access.

[ghost]

You don't need to "hide" your XSS Script on the tags... You can also paste it on the content editor itself (Just use Source Code Action Button on TinyMCE).

PS. To be serious, next to my post on your first XSS Issue, you may can easily fixs this by using strip_tags() or an regexp, which removes all non-alphanumeric characters... And my "hacky" XSS may can only be fixed using a big library, such as Kses.

[dignajar]

Hi guys,
there are someplace where we need to filter Javascript code or any kind of code, for example in tags, or category names, etc..

But there are places such as the page content where I like to keep the user publish Javascript, for example, to embed Tweets, Google maps, or any kind of embed code.

Regards

[zongdeiqianxing]

if you think there is not a risk , you can ignore it