Cross-site Scripting and CSRF in TorrentTrader Classic v1.08
Application: TorrentTrader Classic v1.08, possible other versions.
1. Input passed to the msg property of account-inbox.php is not properly
sanitized before being displayed to the user. A malicious authenticated user
can execute arbitrary HTML and scripting code in a user's browser session in
context of an affected web site.
2. The application allows users to perform certain actions via HTTP requests
without performing any validity checks to verify the request. A malicious
person can perform a CSRF attack.
Vulnerability #1 was discovered by Dominus.
Original URL: http://www.securitylab.ru/vulnerability/347887.php