X7Chat <= 2.0.2 avatar XSS injection=0D
=0D
Discovered by: Nomenumbra=0D
Date: 6/4/2006=0D
impact:moderate (privilege escalation,possible defacement)=0D
=0D
X7Chat versions 2.0.2 and below are prone to XSS injection in a user's avatar.=0D
By setting this as the url of your avatar:=0D
=0D
javascript:alert('xss')=0D
=0D
you'd have some good ol' XSS=0D
=0D
Nomenumbra/[0x4F4C]