1 post • joined 25 Aug 2009
Not just a funny breadcrumb
Not only was this URL-supplied data cached for subsequent visitors but the next day after the breadcrumb fiasco was shown, I found an injection hole in Sears' Craftsman.com website. I was able to place images (and with the img tag, scripts) into the breadcrumb which could have been used to hijack user accounts. (Not that I know anyone with a Craftsman.com account but I suspect they exist.)
Typical unsanitized user data being shown on screen but with the idiocy magnified a thousandfold due to the caching of that data for the next user.
- +Comment Trips to Mars may be OFF: The SUN has changed in a way we've NEVER SEEN
- Vid Google opens Inbox – email for people too stupid to use email
- Back to the ... drawing board: 'Hoverboard' will disappoint Marty McFly wannabes
- Pic Forget the $2499 5K iMac – today we reveal Apple's most expensive computer to date
- Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...