Re: Zend studio location Cross-Domain Scripting Vulnerability
| From: | Thijs Lensselink | Date: | Wed, 13 Oct 2010 04:25:40 +0000 |
| Subject: | Re: Zend studio location Cross-Domain Scripting Vulnerability | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-308666@lists.php.net to get a copy of this message | ||
On 10/13/2010 12:19 AM, Daevid Vincent wrote:
http://80vul.com/Zend%20studio/Zend%20studio%20location%20Cross.htm Interesting. A co-worker and I were JUST noticing how our PHPDoc comments were being parsed pretty much verbatim including<b> tags and links and stuff and thought, "wow, that's stupid, that's just a XSS or injection waiting to happen". LOL. Guess someone's ears were burning. ;-)Why didn't you inform Zend before you went full disclosure? It's a nasty bug though!!