Xkeeper0/jul — Issue #1: Filter bypass -> Javascript injection
Author: RenaKunisaki
Created: 2011-11-10 08:27:17+00:00
State: open

Since dofilters() in lib/functions.php executes its filters in order, only once, it's possible to use some later filters to bypass earlier ones, e.g.:

<scrautoplayipt>alert("Javascript injection!")</scrautoplayipt>

%BZZZ% also makes it possible to inject syntactically script, though there may not be any way to make it execute since it will always begin with a call to a nonexistent function.