Our staff have been both technical services providers and managers of IT departments, this enables us to help you to understand your options through independent advice. | Rialto forminfo.asp refno Variable XSS |
| Sunday, 19 November 2006 | |
|
Rialto contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'refno' variable upon submission to the forminfo.asp script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. Read more... |