A stored XSS instance in CSDN can steal user cookies (this vulnerability is contagious)

CSDN stores stored XSS somewhere, which can steal user cookies.

The problem lies in the personal search. The title and tag are not filtered. After an XSS statement is inserted, it can be executed.

The premise of influencing others is that the other party adds you as a friend. When you add a search for a secret, it will be updated in the dynamic whole site. Once updated, it will be triggered... In addition, the whole community will be involved in looking at the dynamic site.

See the figure.

 

 


 

 

Solution:
Filter...