n0where

I reported an XSS vulnerability in SimpleID’s login page and they fixed it right quick:

quine@durandal% diff simpleid-0.6.4/www/user.inc simpleid-0.6.5/www/user.inc  
27c27
<  * $Id: user.inc 99 2009-05-08 10:12:51Z kmo $
—-
>  * $Id: user.inc 161 2009-08-25 11:29:19Z kmo $
292c292
<     if ($state) $xtpl->assign(‘state’, $state);
—-
>     if ($state) $xtpl->assign(‘state’, htmlspecialchars($state, ENT_QUOTES, ‘UTF-8’));
359c359
<             header(‘X-XRDS-Location’, SIMPLEID_BASE_URL . ‘/index.php?q=xrds/’ . $uid);
—-
>             header(‘X-XRDS-Location: ’ . SIMPLEID_BASE_URL . ‘/index.php?q=xrds/’ . $uid);

Amazing how just a few characters makes such a difference. Also, CJI was kind enough to open an OSVDB entry for this on my behalf. Now *I* just have to mangle it…