在文件1_modcp_editpost.tpl.php里代码: ..... <? } elseif($action == 'editmessage') { ?> <textarea type="text" id="message_<?=$pid?>" name="message_<?=$pid?>" style="width: 80%; height: 200px; overflow: visible" ondblclick="doane(event)"><?=$orig['message']?></textarea> <p style="margin: 5px; text-align: center;"> <button type="button" value="true" class="submit" onclick="submitmessage('<?=$pid?>');this.disabled=true">提交</button>&nbsp;&nbsp; <button type="button" class="submit" onclick="ajaxget('modcp.php?action=editmessage&pid=<?=$pid?>&tid=<?=$tid?>&editmessagesubmit=yes&inajax=1&do=notupdate', 'postmessage_<?=$pid?>')">取消</button> </p> <script type="text/javascript"> ...... <?=$orig['message']?>没有过滤导致xss....
在文件1_modcp_editpost.tpl.php里代码: ..... <? } elseif($action == 'editmessage') { ?> <textarea type="text" id="message_<?=$pid?>" name="message_<?=$pid?>" style="width: 80%; height: 200px; overflow: visible" ondblclick="doane(event)"><?=$orig['message']?></textarea> <p style="margin: 5px; text-align: center;"> <button type="button" value="true" class="submit" onclick="submitmessage('<?=$pid?>');this.disabled=true">提交</button>&nbsp;&nbsp; <button type="button" class="submit" onclick="ajaxget('modcp.php?action=editmessage&pid=<?=$pid?>&tid=<?=$tid?>&editmessagesubmit=yes&inajax=1&do=notupdate', 'postmessage_<?=$pid?>')">取消</button> </p> <script type="text/javascript"> ...... <?=$orig['message']?>没有过滤导致xss. 进入以上的代码的有2处: 1. 1_viewthread.tpl.php里: 00278: <td class="postcontent" <? if($forum['ismoderator'] && ($thread['digest'] >= 0 || !$post['first'])) { ?> ondblclick="ajaxget('modcp.php?action=editmessage&pid=<?=$post['pid']?>&tid=<?=$post['tid']?>', 'postmessage_<?=$post['pid']?>')"<? } ?>> 00279: <div class="postinfo"> 通过ondblclick事件触发ajaxget去访问. 2. \Beijing2008\forumdisplay.htm 00224: </td> 00225: <th class="$thread[folder]" {if $forum['ismoderator']} ondblclick="ajaxget('modcp.php?action=editsubject&tid=$thread[tid]', 'thread_$thread[tid]', 'specialposts');doane(event);"{/if}> 00226: <label> 同上下面的利用是用的1_viewthread.tpl.php里的方法. Discuz! 6 1.发表新贴 ->帖子内容:<script>alert(document.cookie)</script> 2.对帖子有管理权限的用户"双击"讨论帖进入便捷编辑模式，将触发XSS.
