19楼(19lou.com)长期型XSS、敏感信息泄露及修复[网络技术]

个人空间DIY时可以利用expression,IE6、IE7测试通过

http://blog.19lou.com/?18202069 (请用IE6,IE7查看)
http://blog.19lou.com/user/69/diy_css_18202069.cache.css

在DIY中,sql处理过慢时,会呈现近似以下:
Time: 2010-7-30 7:28pm
Script: /spacecp.php

SQL: UPDATE [Table]userspacefields SET layout='1', showside='0', choiceblockmain='newblog,mythread,bbsthread,newimage,newgoods,newfile,newlink', choiceblockleft='photo,action,calendar,archive,search,visitor,track,friend,guestbook,comment,favorite,userlink,music,

information,rss', choiceblockright='', diy='a:28:{s:9:"bodycolor";s:0:"";s:9:"bodyimage";s:0:"";s:10:"bodyrepeat";s:0:"";s:14:"bodyattachment";s:0:"";s:9:"headcolor";

s:0:"";s:9:"headimage";s:0:"";s:13:"headtextcolor";s:0:"";s:10:"headrepeat";s:0:"";s:12:"contentcolor";s:0:"";s:12:"

contentimage";s:0:"";s:13:"contentrepeat";s:0:"";s:9:"sidecolor";s:0:"";s:9:"sideimage";s:0:"";s:10:"siderepeat";s:0:"";

s:15:"blocktitlecolor";s:0:"";s:15:"blocktitleimage";s:0:"";s:19:"blocktitletextcolor";s:0:"";s:16:"blocktitlerepeat";s:0:""

;s:10:"blockcolor";s:0:"";s:14:"blocktextcolor";s:0:"";s:10:"blockimage";s:0:"";s:11:"blockrepeat";s:0:"";s:9:"maincolor";

s:20:"expression(alert(1))";s:9:"mainimage";s:0:"";s:10:"mainrepeat";s:0:"";s:9:"fontcolor";s:0:"";s:9:"linkcolor";s:0:"";s:6:"cursor";s:0:"";}' WHERE uid='18202069'
Error: MySQL server has gone away
Errno.: 2006

Similar error report has beed dispatched to administrator before.

修复筹划:
改正x-space源码,过滤出问题位置.当然cookie重要部份利用了HttpOnly,很不错.