Re: [Full-disclosure] Cross Domain XMLHttpRequest

["Michal Majchrowicz" <m.majchrowicz@xxxxxxxxx>]

Hi,
Thanks for suggestion. Please try it now :)
But as I said before this script WASN'T INTENDED to be safe at all :)
I wanted to show that it is posssible to perform some kind of Cross
Domain Requests. Thats all :)
Regards Michal.

On 4/15/07, Stefan Esser <sesser@xxxxxxxxxxxxxxxx> wrote:
> Hello,
>
> > Thanks for showing this vulnerability :) In fact it was not supposed
> > to be safe, but now it shoud be :) You are right this is not a
>
>
> adding
>         if(strstr($_GET['url'],"file:"))
>                 die;
> is not safe at all...
>
> Regard,
> Stefan
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/