A XSS-CSRF Worm Used to Work on kaixin001.com