I could have put something on that page to steal your cookie contents. Would I have been able to do anything interesting with this interesting looking page as an admin user?
Thanks for testing this stuff out! That admin page is actually broken, I don't actually have a working admin page. As for the XSS stuff, I'm going to go fix that.
Comments
XSS Proof of concept. I've injected javascript into this page:
http://debate-zone.com/zones/15
Escape your inputs properly or suffer cookie stealing and session hijacking XSS attacks.
I could have put something on that page to steal your cookie contents. Would I have been able to do anything interesting with this interesting looking page as an admin user?
http://debate-zone.com/admin
Thanks for testing this stuff out! That admin page is actually broken, I don't actually have a working admin page. As for the XSS stuff, I'm going to go fix that.