Changtu is unauthorized to modify other people's information and play the background blindly

Unauthorized modification of others' information
Http://www.trip8080.com/user/contactShowModify.jspx? Apsaradb for memberId = 8679

 

Storage XSS
Http://www.trip8080.com/chezhan/chengdushi/chengdushi13994.html
The whole site basically does not filter xss. After a rough look, there are several places where xss is stored.
I want to make corrections. I want to add and comment.

 

Blind playing background

 



 

Solution:

The verification ID belongs to the current user.
Filter xss