Attackers can directly log on to the personal homepage page of street network to steal cookies.

Edit the archive and submit the XSS fields that do not filter the school name, such as major and description.
When others view your personal homepage, the display is not filtered.
At the same time, the DJ_RF and DJ_RF2 addresses stored in the cookie can be directly logged on to the street network.
 
Attackers can steal cookies and log on directly.
Http://www.dajie.com/account/login? Auth_str = Value & url = http % 253A % 252F % 252Fwww.dajie.com % 252 Fcard % 252 Fmaybeknow % 253 Ftrk % 253 Dforward

 
Solution:
Filter ....... It is necessary to store such a value in the cookie...
 
Author aomm