The $editbio variable looks to be untouched allowing just about any arbritary data to be inserted into someone's profile allowing for onclick style cookie stealing etc.
Line 312: $bio=$editbio;
This is left unchecked until inserted into the database on line 364:
Quote:
|
$query = "UPDATE {$Globals['rp_db_prefix']}users SET email='$email',homepage='$homepage',icq='$icq',aim='$aim',yahoo='$yahoo',birthday='$birthday',interests='$hobbies',occupation='$occupation',bio='$bio',location='$location',offset='$offset' WHERE userid=$uid";
|
Reference original report made about PhotoPost:
http://marc.theaimsgroup.com/?l=bugt...5868402859&w=2 
Linear Mode
