Search for reflective XSS vulnerabilities and repair of Sina happy Database

 

Brief description:

There are reflected XSS vulnerabilities in Sina music library's music topic search function and followed person search function

Detailed description:

Vulnerability POC connection:

 

Http://music.sina.com.cn/shequ/mu_center/muc_topicdetail.php? Name = % 22% 3E % 3 Ciframe % 20 onload % 3 Dalert (document. domain) % 3E

 

Http://music.sina.com.cn/shequ/mu_center/muc_attention_list.php? Key = % 22% 3E % 3 Ciframe + onload % 3 Dalert % 28document. domain % 29% 3E & type = list & sinaid = 2181491501 & atten = 0

Proof of vulnerability:

 

Solution:

Perform HTML encoding before the user's search input is included in the response.

 

From WebSPRing @ wooyun