Bugtraq mailing list archives

PHPSimple Choose v0.3


From: luny () youfucktard com
Date: 24 May 2006 23:53:56 -0000

PHPSimple Choose v0.3

Homepage:

http://phpsimplechoose.sourceforge.net
Description:

Do you need to add some fun to your site?  Look no further.  With PHPSimpleChoose you can let your users input terms 
and have one randomly choosen.  Every bit of text is changeable, and we are working on allowing you to choose how many 
text boxes there are.  We have also intergrated many <span> elements to allow CSS customization.

Effected files:

Input forms on PHPSimpleChoose

The input forms don't sanatize user input before dynamically generating it. This could cause users to insert malicious 
data.

Proof of concept:

Try entering [IMG SRC=javascript:alert('XSS')] in the input boxes.


Current thread: