|Main Archive Page > Month Archives > full-disclosure-uk archives|
*cough* not just listmembers.php but everywhere $show is used.. anyway..it's dumb but it's there.
> In listmembers.php, $show fails to properly sanitize user-supplied input.
> It's non persistent XSS :-/
> kefka [at] kevinbeardsucks.com
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/