1 post • joined 25 Aug 2009
Not just a funny breadcrumb
Not only was this URL-supplied data cached for subsequent visitors but the next day after the breadcrumb fiasco was shown, I found an injection hole in Sears' Craftsman.com website. I was able to place images (and with the img tag, scripts) into the breadcrumb which could have been used to hijack user accounts. (Not that I know anyone with a Craftsman.com account but I suspect they exist.)
Typical unsanitized user data being shown on screen but with the idiocy magnified a thousandfold due to the caching of that data for the next user.
- Just TWO climate committee MPs contradict IPCC: The two with SCIENCE degrees
- 14 antivirus apps found to have security problems
- Apple winks at parents: C'mon, get your kid a tweaked Macbook Pro
- Feature Scotland's BIG question: Will independence cost me my broadband?
- Driverless car SQUADRONS to hit Britain in 2015