Fresh fruit Netcom has been planted with CSRF, and XSS outbands are reflective (including repair)

The problem lies in subscription management. It is obvious that it is okay to create a directory with the UNICODE code ~~ It is a pity that the location is not very obvious, so we can see how to use it .. So I thought of combining CSRF to implant XSS code. Therefore, see the vulnerability proof. -------------------- Method of exploits: user access to the Trojan page | CSRF creates an XSS directory | JS redirects http://xianguo.com/my/feeds Trigger (it seems that I have not found a place to delete this directory. What do you think) xianguo.html Two reflections, wondering why you didn't scan them out? Http://xianguo.com/search? SearchType = all & keyword = 88952634 keyword = 88952634 "> <script> alert (document. cookie); </script> http://xianguo.com/passport/widget-login? Alert "> <script> alert (document. cookie); </script>
Solution:Filter