Tudou storage-type XSS test successfully obtains the user identity

Let's briefly talk about it this time. During the video playing process of Tudou, if there is another video, it will be about 10 seconds at the end, the system will prompt "the video to be played next is XXXX", that is, before playing back, Tudou will read the content in the next video and wait for execution. At this time, the title name of the video is obtained. Because of this, XSS is available... If the title of the next video contains an xss statement in the current Playing track, the XSS is triggered when the next video is read at the end of the video .. If a COOKIE-stealing link is added to the title of the video, the access will be triggered .. Http://www.tudou.com/programs/view/zfkZlYZByHI/ test video address when video access to 3 minutes 30 seconds, you can trigger XSS... There are two other places, but they are all chicken ribs .. See .. 10 seconds before the end of the video, the system will prompt "XXX video to be played for you". XSS is triggered at this time .. The information obtained after triggering is the administrator of a small bean ticket.


 Solution:Filter it...