Our staff have been both technical services providers and managers of IT departments, this enables us to help you to understand your options through independent advice. | Rapid Classified reply.asp Multiple Variable XSS |
| Sunday, 19 November 2006 | |
|
Rapid Classified contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'name' or 'id' variables upon submission to the 'reply.asp' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. Read more... |