There is a Permanent-type Cross-Site Vulnerability in “Personal Signature” in all version of Discuz!. It can be written by the worm!

There is a Permanent-type Cross-Site Vulnerability in “Personal Signature” in all version of Discuz!. It
can be written by the worm!

Discuz! do not filter the Malicious code when user enter their personal signature, attacker can enter the
xss code, Discuz! will save and run it! It maybe lead the propagation of worm!

For example:

we can register an user, and enter the xss code to our personal signature!

like:
</textarea><script>alert(/Liscker/);</script><textarea>

Vulnerable: Discuz! <=7.2 all version!

Liscker
2010.03.24