TP-LINK official online store storage XSS

Source: Internet
Author: User

TP-LINK official online store storage type XSS a boring to visit TP-LINK to see the wood has a new product website have read the side found that the filter are filtered to see that the welcome behind is what we wrote at the Registration the account cannot be changed, I don't know if there is a wooden filter in this place. But if it is registered normally, the page will check whether the content in the box is swollen or not? Try to register and capture packets normally, and then change the packet and resend the packet to see if memberName = is our user name changed to our XSS statement, and then Replay sends the modified package. Oh, what is the situation?
No filtering amount =============================================================== imagine, now we replace the Xss statement with the cookie truncation statement xsser. the one in me. Then, when we leave a message at the product, will our user name be displayed? Executed? You can also buy something? Hmm? Is it executed? I cannot perform tests because I am not an administrator or the seller cannot review or view messages. If the above ideas come true, all these cookies will be handled, the back-end management of pai goes up, and the seller's account pai goes up, so it should be a little dangerous XSS vulnerability, right? PS: It feels a bit nonsense .......Solution:Check the content in the POST submission and filter the content

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.