Sina Weibo micro-girl storage XSS and Restoration

Sina micro Bo micro girl Community reply storage type XSS, everything has been filtered.

Check the number of words locally, and do not check the server. You can easily bypass the limit of 100 words.

Directly insert XSS code, you know ~~~

Example, http://vgirl.weibo.com/bbs/view_topic.php? Tid = 3136 & vid = 10 11th replies (managed deletion is not ruled out)


1. Write something at will and submit and cut packets at the same time.

 

2. Keep up with the Cross-Site Code directly after the text in the content

 

3. pop-up window

 

4. Review elements. The cross-site code is hosted in it ~

 



 

Solution:

The server checks whether the number of words exceeds 100 characters.

Purify input and filter output ~~

Related interface token