Attackers can bypass the VIP and random access restrictions of the six-room dance music.

When the number of people in the room is 3000, you will be prompted to enter.
If the source code of the webpage is obtained before the window is displayed. After the pop-up, modify the source code before the pop-up page to bypass the VIP and random restrictions.


After

Before
After the window pops up, remove the following code.

Default: // normal Template
Page. uid = pageMessage. user. uid;
Var _ iszhan = parseInt ('0 ');
If (page. puid! = Page. uid & page. liveType = 0 & (page. myVideo. url! = ''| _ Iszhan = 1) {// video
Page. isVideo = 1;
If (_ iszhan = 1 ){
Swfobject. embedSWF ('apple/musicPlayer/smallShow.swf ', 'videoplayer', 464,457, '10. 1', page. noF, {uid: page. rid}, {wmode: 'opaque '});
Document. getElementById ('pretopgift '). style. display = 'none ';
} Else {
Var vvp = page. myVideo. type = 2? Page. VplayerPP: page. Vplayer;
Swfobject. embedSWF (vvp, 'videoplayer', page. fw, page. fh, '10. 1', page. noF, {vid: page. myVideo. url, pvid: page. myVideo. url, flag: 1, model: 1 },{ wmode: 'transparent '});
}
} Else {
If (page. puid = page. uid) {// homeowner
Var g_fx1_installed = false;
(Function (){
Try {
G_fx1_installed = PlugTest ();
} Catch (e ){
SetTimeout (arguments. callee, 50 );
Return;
}
Var userInfo = Login. getUserInfo ();
Page. liveMaster = 1;
Memo = encodeURIComponent ("{'url': '" + location. href + "'}"); // parameter set

// Var wmode = Browser. firefox? 'Window': 'opaque ';
Swfobject. embedSWF (page. mplayer, "videoPlayer", page. fw, page. fh, "10.1", page. noF, {uid: page. uid, userName: pageMessage. user. username, userPassword: userInfo. pwd, fx264: g_fx1_installed, cooperateid: '', memo: memo, v6size: '000000'}, {wmode: 'opaque ', allowscriptaccess: 'alway '}, {id: 'videoplay '});
If (page. liveType = 0 & page. myVideo. url! = ''){
Var _ div = document. createElement ('div ');
_ Div. id = 'changeplayerbtn ';
_ Div. className = 'vvideobtn ';
_ Div. innerHTML = '<em onclick = "return changePlayer ()"> </em> ';
Document. getElementById ('video'). appendChild (_ div );
}
})();

} Else {
Var autoPlay = page. liveType = 10? 'True ':'';
Swfobject. embedSWF (page. fplayer, 'videoplayer', page. fw, page. fh, '10. 1', page. noF, {mute: 0, fileName :( page. flvTitle & page. flvTitle [1]. flvtitle? Page. flvTitle [1]. flvtitle: ''), autoplay: autoPlay/* Automatic stream fetch */, libUrl: 'http: // rio.6rooms.com/lib/lib.asp', ServerURL: page. uploadurl },{ allowscriptaccess: 'alway', wmode: 'opaque '});

}
}
}
})
. Script (JSF. mt). wait ()
. Script (JSF. z). wait (function (){
If ($6 ('myaccounttool ')){
ControlCenter = new ControlCenter ({centerBtn: $ ('myaccounttool ')});
}
 
If (Browser. name = 'ie' & Browser. version = 6 ){
$LAB.script(JSF.png). wait (function (){
DD_belatedPNG.fix ('. talentshowIco ');
})
}

})
. Script (JSF. room). wait (function (){
AddReady (function (){
SetTimeout (function (){
Var _ imgs = document. getElements ('img [data-src] ');
For (var I = 0; I <_ imgs. length; I ++ ){
_ Imgs [I]. src = _ imgs [I]. getAttribute ('data-src ');
_ Imgs [I]. removeAttribute ('data-src ');
}
},500 );
Room. init ();
});
})

. Script (JSF. im)
. Script (JSF. mission );
If (_ tpl __! = 'Game') {// sidebar
$ LAB. script (JSF. gmsg );
}
</SCRIPT>


Solution:

Modification prohibited.