DealsAndYou, why you no sanitize inputs?

Standard
Dealsandyou.com, Y U NO sanitize input

Dealsandyou.com, Y U NO sanitize input

Update: Dealsandyou has fixed the bug. Responded on twitter with a thanks.

Click to see full-size image.

dealsandyouthanks

I was looking at dealsandyou.com a couple of days back and something (may be their bad design) made me do a XSS vulnerability test on their “Search” input box using the XSS Locator code snippet. Voila!, an alert box popped up confirming my hunch. Continue reading