Wc3edit.net steals swat cookies now - tryout a XSS attack

[Dekar]

Since redscull took some time to understand how XSS works (no offence, it just isn't that easy!) I made a proof of concept.
Wc3edit.net now steals the swat account cookie for every user who visits this forum and is logged in his swat account.
This data _doesn't_ allow anyone to access your account (I didn't plan to abuse it) but simply shows the vulnerability.

Here you can see the cookies it logged so far:
http://dekar.wc3edit.net/logger.php

To try it out just make an account at http://night.org/swat2/playerdb/index.php?p=new and visit wc3edit.net after logging in there.

[Hmmz0r]

I have no idea what this does, but it sounds Dangerous o.O

[Dekar]

http://en.wikipedia.org/wiki/Cross-site_scripting
Yeah kinda... could delete/steal data... But I'm not evil

[Hmmz0r]

That truly is evil

[Dekar]

Okay the party is over, he finally fixed it