Mac-based youdao dictionary XSS Vulnerability

Mac-based youdao dictionary XSS Vulnerability

Mac-based youdao dictionary, which has the XSS vulnerability during word translation. You can easily refer to the box using SVG labels.

Detailed description:

1. Open the youdao dictionary and select the "word selection" function. At this time, as long as any word is selected, youdao will go to the background to query the Translation results and display them in a floating box.



2. Select "> <svg/onload = prompt (1)> (note that the angle brackets starting from double quotation marks on the left side to the rightmost side are successfully selected ).

Proof of vulnerability:

Why can't I upload GIF images?

Solution:

Filter