[CMS] Staff page by Hejula

[Spartak]

sorry but i just found a simpl and easy xss fail :s

Just go to ur hotel and type in ur mission

<script>ALERT('fail xss detected by Spartak')</script>

and come back to ur staff page....wow

to fixe that add a simple htmlspecialchar befor username etc...

 

[Zippy]

sorry but i just found a simpl and easy xss fail :s

Just go to ur hotel and type in ur mission

<script>ALERT('fail xss detected by Spartak')</script>

and come back to ur staff page....wow

to fixe that add a simple htmlspecialchar befor username etc...

Lol, just tried that and it doesn't work (Y)

 

[Spartak]

...it does and look at the code..not secured.

 

[TesoMayn]

This staff page works fine.

 

[Zippy]

...it does and look at the code..not secured.

Why does it need securing? You are mad! No data is in putted by the user, meaning they can not do SQL exploit. You can not register usernames with ' or " so no staff will have usernames like that. So stop nit picking and have a bath.

 

[ZOF]

download link broken

 

[sdsds]

Download is broken

 

[Sledmur]

Is there an updated link? This one seems to be broken

 

[kyrpted]

Is there a new link? This one is broken.

 

[PinkPowah]

New Download Link! :

You must be registered for see links

 

[Heaplink]

Remember to edit your posts instead of double post

 

[Noman]

download link dun work lolol.

 

[Ryabs]

As I Said Above On My Old User :

You must be registered for see links

 

[Crup]

Looks nice ')

 

[funkyben]

Um why is this user imputed e.g have to put in (hotelname)(.org/com)/staff instead of a button

 

[Hejularr]

Um why is this user imputed e.g have to put in (hotelname)(.org/com)/staff instead of a button

What?

 

[funkyben]

I have to type in (my hotel url) habbolike-hotel.zapto.org/staff
to view this page instead of having a button,
'cause the button only shows when i'm on the staff page, visit my link (register if you have to)
and see for urself

 

[Hejularr]

You have to put the button on the pages... this is just 1 page not a whole CMS modification.

 

[Gajeel]

I have to type in (my hotel url) habbolike-hotel.zapto.org/staff
to view this page instead of having a button,
'cause the button only shows when i'm on the staff page, visit my link (register if you have to)
and see for urself

You need to manually add them over.

 

[funkyben]

And how do i do that???