Re: [PHP] This code using _GET exploitable

[Michael A. Peters]

filtered wrote:
Hi,
we have script containing

 <? echo $_GET['studio'] ?>

http://www.yourwebsite.org/yourpage.php?studio=<script>alert('xss');</script>


and

    <?
        $cam = $_GET['cam'];

        if ($cam == '1') {
            echo '<img src="http://example.com"";  />';
        }
   ?>

That I don't think is exploitable since you are not doing anything with 
cam directly but are only acting if it is a string matching '1'.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php