Sina light blog cross-site and repair

Sina light blog does not strictly filter the URL of the album art when publishing music, leading to cross-site filtering.
Detailed description:
 
 
When publishing music, Sina light blog normally submits the following request:
 
 

 
However, the screen parameter is not strictly filtered. The modification parameters are submitted as follows, resulting in cross-site scripting.
 
Warning "onload = alert ('xss ')"
Proof of vulnerability:
 
 
Solution:
 
Music Publishing filters screen parameters.
 
Prepared by viekst @ wooyun