TomPDA's XSS can obtain and fix user cookies

Brief description: After you access the XSS page, a prompt box is displayed for cookie information, account password, and other information;
If you re-create a page, insert the page containing XSS and obtain the prompt box content;
The Administrator will steal the cookie information and store it in the hands of intruders,
So as to achieve the purpose of intruders (there are many other methods)
Details: 1. registration page:
Http://www.tompda.com/register/
2. After registration, modify the Email in the document and insert the XSS statement.

Modify data page http://www.tompda.com/bbs/edituser.asp

XSS statement <script> alert (document. cookie) </script>
3. When Logon B accesses the personal data inserted with XSS Statement A, A prompt box is displayed, showing the cookie information of user B.

A has many methods to obtain the cookie information. There are two simple examples:
(1) If QQ has B, it is required to open A remote connection and access the C page. When A prompt box is displayed, A is retained.
(2) Let B access the constructed page, jump to Page C, and save the prompt box content by means.

After obtaining the Administrator information, you can use shell in the background. It's also a mall station ..
I didn't test other XSS statements. I hope the owner can take charge of them and filter out all the XSS of Shenma ..
Proof of vulnerability: personal information of the test user:
Asp? Username = 521.im"> http://shop.tompda.com/mall/userinfo.asp? Username = 521.im

Cookie Information prompt box (User Alan_Test, not 521.im ):

Solution:
Sorry, I really dont know ~ Because you know ..