gregglind/OpenSiri — Issue #1: Flaw in ask.opensiri.com
Author: Djayb6
Created: 2011-11-09 00:39:39+00:00
State: open

There is a big XSS flaw in the form at http://ask.siri.com, one can execute any javascript code and even hijack cookies. You should protect each user input with htmlentities() to begin with.