xss exploit in cnr

[MiNi.SpIdEr]

HI every body
one of my friends find an XSS problem in CNR search page

i test it here

http://english.cutenews.ru/cuteru/examp ... Cxxx%20%22

look after it


thx
see ya

[Chaser]

In search.php move the line 55 "$search = htmlspecialchars($search);" to the top of the page.

Code: Select all

<?
include_once 'head.php';

$search = htmlspecialchars($search);

$sday[] = '';

...

[MiNi.SpIdEr]

thx
it's work very good