Tencent Weibo private message interface storage XSS and repair

1. Send a private message with the following content:

2. Of course, direct access to private messages is not a problem, but there are two json interfaces related to private messages.

The following interface is used to return the number of users with private messages, and the colleague returns the last private message, including the number of returned records:
Http://api.t.qq.com/inbox/pm_list.php

The following interface returns and specifies the user's private message content, including the number of returned records:
Http://api.t.qq.com/inbox/pm_conversation.php? Account = xxx </code>

3. Because the Content-Type returned by the above two interfaces is text/html, charset = UTF-8, and oc in the returned private message json data is also private message Content, but it is not encoded, the direct output is: . This vulnerability may occur.


Send a private message to a user, but find a way to access the interface address.

 

 

 

Solution:
1. Specify Content-Type as application/json; charset = UTF-8
2. html encoding of oc values