Warning: Constant UC_APPID already defined, this will be an error in PHP 9 in C:\wwwroot\9et.cn\bbs\config.inc.php on line 83
Warning: htmlspecialchars(): Charset "gbk" is not supported, assuming UTF-8 in C:\wwwroot\9et.cn\bbs\include\common.inc.php on line 84
Warning: Constant FORMHASH already defined, this will be an error in PHP 9 in C:\wwwroot\9et.cn\bbs\include\common.inc.php on line 254
Warning: Undefined variable $uchome in C:\wwwroot\9et.cn\bbs\include\common.inc.php on line 405
Warning: Trying to access array offset on null in C:\wwwroot\9et.cn\bbs\include\common.inc.php on line 405
Warning: Undefined variable $feedpostnum in C:\wwwroot\9et.cn\bbs\include\common.inc.php on line 413
Warning: Undefined array key "types" in C:\wwwroot\9et.cn\bbs\viewthread.php on line 115
Warning: Trying to access array offset on null in C:\wwwroot\9et.cn\bbs\viewthread.php on line 115
Warning: Undefined array key "types" in C:\wwwroot\9et.cn\bbs\viewthread.php on line 116
Warning: Trying to access array offset on null in C:\wwwroot\9et.cn\bbs\viewthread.php on line 116
Warning: Undefined variable $ismoderator in C:\wwwroot\9et.cn\bbs\viewthread.php on line 184
杰特论坛 - Powered by Discuz! Board
标题: QQ最新漏洞:QQ2010SP1聊天记录能执行Html代码 [打印本页]
作者: 游戏 时间: 2010-8-3 10:36 标题: QQ最新漏洞:QQ2010SP1聊天记录能执行Html代码
腾讯QQ一向是腾讯主打的产品，意想不到前天发布的QQ2010SP1竟然有如此大漏洞。用户可以随意在消息中使用Javascript、Html，腾讯并没有对此进行有效的屏蔽，如此低级漏洞，在QQ这样的软件中出现实属罕见，可能是那天给骂糊涂了。
截止发稿之日起，腾讯还没有对此漏洞给出解决办法，首先囧一下：脚本出错还会提示错误
1、消息记录的Javascript、Html标签没有屏蔽
2、消息盒子Javascript、Html标签没有屏蔽
3、小实验
发送代码：<input />
因为腾讯会自动将url转换，我们必须混淆url才能发送
4、超牛代码
<img src=’tetet’/>
因为要点击才能触发，想到一个不用点击就能触发的代码。希望腾讯快点修复，本漏洞由TGL发现。