JS embedding @ www.reed.co.uk

["elaborate ruse" <elaborateruse () trust-me com>]

 Title:         JS embedding @ www.reed.co.uk
 Date:          26.03.02                
 Author:                elab (http://elaboration.8bit.co.uk)
 Problem:               Improper input validation during sign up process allows users to
                embed JavaScript
 Vendor Status: Contacted on:   17:00 GMT 14 March 02   
                Via:            http://www.reed.co.uk/contact.asp 
                Response:       Within 2 hours


 Summary:
                Due to improper input validation users are able to insert/embed
                JavaScript in to certain form fields during the sign up
                process.

                Once the registration process is complete viewing the user's
                profile will download and execute the embedded JS.

 Solution:      
                The problem was fixed by the vendor within 5 working days of
                it being reported.
                
                Now when a user attempts to insert JavaScript in to the sign up
                form they are be redirected to an error page.

 Vendor:
                The vendor was contacted on 17:00 GMT 14 March 02 via an online
                contact form and replied within 2 hours with a professional and
                friendly response.

                Official vendor response:

                "We are happy to acknowledge the part elab played in alerting
                us to an absence of validation on one of our site's forms.
                Although this was never exploited, and has now been corrected
                on the site, we are most grateful to elab for pointing it out".

 Credit:        
                Credit is given to the vendor for handling this issue in the
                correct manner.







_____________________________________________
Free email with personality! Over 200 domains!
http://www.MyOwnEmail.com