[Paul M]

Originally Posted by DementedMindz

report it and have the admins look at it.

I had a look at this tonight.

If this is installed from scratch then it cannot be exploited.

However, because of the the way the fix has been implemented - it is possible that it may still be exploitable if someone updated their older version to the new code, and they had customised the templates, but did not revert or re-edit those templates.

This is because the older versions used $getstats_thread[title], the fix uses $getstats_thread[titletrimmed] - but the old variable is still available, and if displayed by an old template, will still cause a redirect.

The best workaround to this is to make sure you revert any old topXstats templates. The author should fix this properly by making sure that the old variable $getstats_thread[title] is either removed, or also made 'harmless' by using htmlspecialchars().