Chengdu Airlines Co., Ltd. Official Website storage type XSS one can blind playing background

Chengdu Airlines Co., Ltd. Official Website storage type XSS one can blind playing background

The filtering is lax, resulting in XSS and backend cookies, resulting in leakage of sensitive customer information.

Web: http://www.chengduair.cc

Vulnerability webpage link: http://www.chengduair.cc/Feedback.asp

Vulnerability proof
 

The cookie has been hit.
 

All messages are sent to the backend. The information is comprehensive and can be exploited by criminals.
 

 

Solution:

Filter