Discuz! 데이터베이스 오류 정보 xss bug

Discuz!        xss bug

author: 80vul-B
team:[url]http://www.80vul.com[/url]

    

   include\db_mysql_error.inc.php   :


	if($message) {
		$errmsg = "<b>Discuz! info</b>: $message

";
	}
	if(isset($GLOBALS['_DSESSION']['discuz_user'])) {
		$errmsg .= "<b>User</b>: ".htmlspecialchars($GLOBALS['_DSESSION']['discuz_user'])."
";
	}
	$errmsg .= "<b>Time</b>: ".gmdate("Y-n-j g:ia", $timestamp + ($GLOBALS['timeoffset'] * 3600))."
";
	$errmsg .= "<b>Script</b>: ".$GLOBALS['PHP_SELF']."

";
	if($sql) {
		$errmsg .= "<b>SQL</b>: ".htmlspecialchars($sql)."
";
	}
	$errmsg .= "<b>Error</b>:  $dberror
";
	$errmsg .= "<b>Errno.</b>:  $dberrno";

$GLOBALS['PHP_SELF']    ,     sql       $GLOBALS['PHP_SELF']  xss  .


    

                 .

    [fix]

  $GLOBALS['PHP_SELF']