QQ Email in-box xss vulnerability

                                                Author: AmesianX in powerhacker.net([email protected])
Document Link: http://powerhacker.net/mail_qq_com_xss_vulnerability_written_by_AmesianX.pdf
Version: 2012-06-28 (NowTime: 0-Day)
Tested on: IE 9.0, Chrome, FireFox
Patch on:2012-07-02

1. click the E-Mail Write Button

2. Upload file (Only important : BigAttachFile menu)

 - Second upload button(BigAttachFile) is non-flash uploading files.
 - upload filename is "play.txt" of 8 byte.

3. Proxing and Injection

 - Standby BurpProxy Capture-ON
 - Click the Email Send Button
 - Let's see the "bigattachcontent=" value in burpproxy.
 - Change "play.txt" string
 - "play.txt"  --> %22%20onmousemove=%22alert('test')%22%20

4. Injection 2

 - Let's see the "bigattachcontent=" value in burpproxy.
 - Change "8 Byte" string
 - "B" --> %3E

5. off the proxy and send email.

6. let's open the email and move your mouse cursor near around the
attachment file.
 - attend "onmousemove event"

7. reference: click documentation above Document Link (Korean Language)