6 ms·

If you can sneak a <blink> tag into the ticket system, you likely can sneak a in <script> or <iframe> tag as well... I'm sure input sanitization was already a t

If you can sneak a <blink> tag into the ticket system, you likely can sneak a in <script> or <iframe> tag as well... I'm sure input sanitization was already a thing preached back then but ignored by many web developers...

ggambetta 3y ago
My interpretation is that the frontend added the <blink> tag when rendering a critical-priority ticket, no injection needed.
- db48x 3y ago
  No, it was 20 years ago. A lot of projects were really blasé about html injection back then.