Personal information maintenance cross-site Vulnerability

The cross-site service itself has no technical content, but it can directly attack customer service and some website users with a high level.
Description: you can modify the user name and real name when modifying personal background personal information. On the surface, some malicious characters have been processed. You can bypass the actual re-submission of captured packets. The length of related fields is limited, but some actions can be performed.

<Script> window. close () </script>
<Iframe src = http://t.cn/zlZLE2P>
This is enough.
Because the website has the function of asking questions and publishing transfer information, the Customer Service will directly seek help.


 

Solution:

Translation