The repair plan for the e-mobile vulnerability exploitation of the pan-micro-mobile platform
1. Check the validity of the incoming parameters of the vulnerable module, and limit the incoming parameters
2. When the user enters the limited characters, immediately turn to the custom error page, The default error output method of the server cannot be used.
3. Filter the above tags with dangerous characters, and prohibit the introduction of special characters (', ", +, %, &, <>, (), ;, and, select, etc.) 4
. Encrypt the information stored in the database
5. When linking with the database and accessing the data, use the parameterized query method for link access
Pan micro mobile platform e-mobile vulnerability description
Panwei E-Mobile mobile office system uses Apache Struts xwork as the website application framework. Because the software has a high-risk remote code execution vulnerability, attackers can use the vulnerability to remotely execute commands and obtain server permissions.