1 post • joined 25 Aug 2009
Not just a funny breadcrumb
Not only was this URL-supplied data cached for subsequent visitors but the next day after the breadcrumb fiasco was shown, I found an injection hole in Sears' Craftsman.com website. I was able to place images (and with the img tag, scripts) into the breadcrumb which could have been used to hijack user accounts. (Not that I know anyone with a Craftsman.com account but I suspect they exist.)
Typical unsanitized user data being shown on screen but with the idiocy magnified a thousandfold due to the caching of that data for the next user.
- Vid Hubble 'scope snaps 200,000-ton chunky crumble conundrum
- Bugger the jetpack, where's my 21st-century Psion?
- Google offers up its own Googlers in cloud channel chumship trawl
- Windows 8.1 Update 1 spewed online a MONTH early – by Microsoft
- Interview Global Warming IS REAL, argues sceptic mathematician - it just isn't THERMAGEDDON