提交 #735164: BootDo V1.0 Cross Site Scripting

During the security review of "BootDo System",I discovered a xss vulnerability in the "/blog/bContent/save"， .I found that in the ContentController class, does not include XSS filtering resulting in the ability to perform xss

# BootDo System /blog/bContent/save xss vulnerability

# NAME OF AFFECTED PRODUCT(S)

- BootDo

## Vendor Homepage

- /blog/bContent/save

# AFFECTED AND/OR FIXED VERSION(S)

## Vulnerable File

- ContentController class

## VERSION(S)

- v1.0

## Software Link

- https://github.com/lcg0124/bootdo

# PROBLEM TYPE

## Vulnerability Type

- xss vulnerability

## Impact

- Attackers can exploit this reflected XSS vulnerability to achieve unauthorized access to user accounts, hijack user sessions, steal sensitive user data, deface web pages, and even compromise the integrity of the entire website, posing a serious threat to user privacy and the normal operation of the business.

# DESCRIPTION

- I discovered a xss vulnerability in the " /blog/bContent/save" .

# No login or authorization is required to exploit this vulnerability

# Vulnerability details and POC

## Vulnerability lonameion:

- 'content、author、title‘ parameter

## Payload:

<img width="1884" height="1032" alt="Image" src="https://github.com/user-attachments/assets/6bb102e9-9b7c-418d-8613-f592c13b1f1b" />

<script>alert(123)</script>

<img width="2507" height="1268" alt="Image" src="https://github.com/user-attachments/assets/1ab9eeca-4c5c-456b-89cb-b5df9c0a408f" />

The save method in the ContentController class does not include XSS filtering.

<img width="1425" height="1002" alt="Image" src="https://github.com/user-attachments/assets/0abcf459-6b95-4b51-b002-0e5c1cdbb60d" />

# Suggested repair

1. **Encode output data:**
Encode all user-generated content before displaying it on a web page. This ensures that any potentially malicious scripts are treated as plain text rather than executable code. For example, convert special characters such as <, >, and & to their respective HTML entities (&lt;, &gt;, and &amp;).

2. **Input validation and filtering:**
Strictly validate and filter user input data to ensure it conforms to the expected format.

3. **Use Content Security Policy (CSP):**
Implement a Content Security Policy to restrict the sources from which scripts can be executed.

4. **Regular security audits:**
Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities.

• 来源: ⚠️ https://github.com/webzzaa/CVE-/issues/4
• 用户: Tom132432 (UID 85670)
• 提交: 2026-01-09 10時01分 (5 月前)
• 管理: 2026-01-18 08時18分 (9 days later)
• 状态: 已接受
• VulDB条目: 341726 [lcg0124 BootDo 直到 e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb ContentController /blog/bContent/save content/author/title 跨网站脚本]
• 积分: 20