WS-2013-0004

The "methodOverride" let the http post to override the method of the request with the value of the post key or with the header, which allows XSS attack...