On 13 October 2010 05:25, Thijs Lensselink <d...@lenss.nl> wrote:
> On 10/13/2010 12:19 AM, Daevid Vincent wrote:
>> Interesting. A co-worker and I were JUST noticing how our PHPDoc comments
>> were being parsed pretty much verbatim including<b> tags and links and
>> stuff and thought, "wow, that's stupid, that's just a XSS or injection
>> waiting to happen". LOL. Guess someone's ears were burning. ;-)
> Why didn't you inform Zend before you went full disclosure?
> It's a nasty bug though!!
Yesterday, I installed PDT for the first time.
Created the scenario for this vulnerability.
Get an exception. MS Visual Studio shows a HTML block with the
<script> tag in it and that is highlighted as the error. "Microsoft
JScript runtime error: Automation server can't create object".
Twitter : EE : Zend
@RQuadling : e-e.com/M_248814.html : bit.ly/9O8vFY
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php