系统立体检查提示xss高危漏洞 [复制链接]

版主您好，用立体服务系统检查网站提示xss高危漏洞。请高手指点。谢谢，下面是漏洞描述。


高危 [url]http://www.suiyangqu.gov.cn/e/member/index.aspx[/url]

请求
POST
类型
None
位置
表单
参数
To_Url
测试数据
username=aSdFh1&vcode=1&login=yes&password=g00dPassw0rD1&To_Url='"/><script>confirm(1369)</script>

高危 [url]http://www.suiyangqu.gov.cn/e/member/index.aspx[/url]

请求
GET
类型
None
位置
参数
参数
mustname
测试数据
username=aSdFh1&password1=1&password=g00dPassw0rD1&pa_fax=1&mustfield=email%2Ctruename%2C&mustname=</script><script>confirm(5248)</script>&mobile=1&pa_qq=1&pa_msn=1&truename=1&s=1&pa_from=%E5%85%B6%E4%BB%96%E7%BD%91%E7%AB%99&Reg_type=4&pa_address=1&vcode=1&post=add&musttype=text%2Ctext%2C&type=reg&email=sample%40email.tst&pa_tel=1

高危 [url]http://www.suiyangqu.gov.cn/e/search/search.aspx[/url]

请求
GET
类型
None
位置
参数
参数
page
测试数据
title=&siteid=1&page="/><iframe/src=//www.163.com//>&modelid=49


Flash参数配置风险
受影响页面列表

[url]http://www.suiyangqu.gov.cn/e/incs/paplayer/swfobject.js[/url]

泄露信息

<embed type=\"application/x-shockwave-flash\" src=\""+this.getAttribute("swf")+"\" width=\""+this.getAttribute("width")+"\" height=\""+this.getAttribute("height")+"\"";_19+=" id=\""+this.getAttribute("id")+"\" name=\""+this.getAttribute("id")+"\" ";var _1a=this.getParams();for(var key in _1a){_19+=[key]+"=\""+_1a[key]+"\" ";}var _1c=this.getVariablePairs().join("&");if(_1c.length>0){_19+="flashvars=\""+_1c+"\"";}_19+="/>";}else{if(this.getAttribute("doExpressInstall")){this.addVariable("MMplayerType","ActiveX");}_19="<object id=\""+this.getAttribute("id")+"\" classid=\"clsid27CDB6E-AE6D-11cf-96B8-444553540000\" width=\""+this.getAttribute("width")+"\" height=\""+this.getAttribute("height")+"\">";_19+="<param name=\"movie\" value=\""+this.getAttribute("swf")+"\" />";var _1d=this.getParams();for(var key in _1d){_19+="<param name=\""+key+"\" value=\""+_1d[key]+"\" />";}var _1f=this.getVariablePairs().join("&");if(_1f.length>0){_19+="<param name=\"flashvars\" value=\""+_1f+"\" />";}_19+="</object>";}return _19;},writeunction(_20){if(this.getAttribute("useExpressInstall")){var _21=new deconcept.PlayerVersion([6,0,65]);if(this.installedVer.versionIsValid(_21)&&!this.installedVer.versionIsValid(this.getAttribute("version"))){this.setAttribute("doExpressInstall",true);this.addVariable("MMredirectURL",escape(this.getAttribute("xiRedirectUrl")));document.title=document.title.slice(0,47)+" - Flash Player Installation";this.addVariable("MMdoctitle",document.title);}}if(this.skipDetect||this.getAttribute("doExpressInstall")||this.installedVer.versionIsValid(this.getAttribute("version"))){var n=(typeof _20=="string")?document.getElementById(_20):_20;n.innerHTML=this.getSWFHTML();return true;}else{if(this.getAttribute("redirectUrl")!=""){document.location.replace(this.getAttribute("redirectUrl"));}}return false;}};deconcept.SWFObjectUtil.getPlayerVersion=function(){var _23=new deconcept.PlayerVersion([0,0,0]);if(navigator.plugins&&navigator.mimeTypes.length){var x=navigator.plugins["Shockwave Flash"];if(x&&x.description){_23=new deconcept.PlayerVersion(x.description.replace(/([a-zA-Z]|\s)+/,"").replace(/(\s+r|\s+b[0-9]+)/,".").split("."));}}else{try{var axo=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.7");}catch(e){try{var axo=new ActiveXObject("ShockwaveFlash.ShockwaveFlash.6");_23=new deconcept.PlayerVersion([6,0,21]);axo.AllowScriptAccess="always"