Our staff have been both technical services providers and managers of IT departments, this enables us to help you to understand your options through independent advice. | Rapid Classified search.asp SH1 Variable XSS |
| Sunday, 19 November 2006 | |
|
Rapid Classified contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'SH1' variable upon submission to the search.asp script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. Read more... |