[CAG CheechDogg]

Originally Posted by loaep

XSS Vulnerability Found.

gxboxlive.php:199: $pagenav = construct_page_nav($pagenumber, $perpage, $gxblcounts['usercount'], 'gxboxlive.php?do=getall', (!empty($sortfield) ? "&sortfield=$sortfield" : "") . (!empty($sortorder) ? "&sortorder=$sortorder" : ""));


OP's last activity was 2011 December, so I'm assuming it won't be fixed.



To fix it yourself, find these lines in gxboxlive.php

	$sortfield = $vbulletin->input->clean_gpc('r', 'sortfield', TYPE_STR);
	$sortorder = $vbulletin->input->clean_gpc('r', 'sortorder', TYPE_STR);

and add under it

	$sortfield = htmlspecialchars($sortfield);
	$sortorder = htmlspecialchars($sortorder);

I know about XSS Vulnerabilities but how high risk is this if we don't add that fix of yours