Additional XSS attack in contact.jsp not counted as passed challenge -- XSS in contact.js

[julianthome]

It is possible to run a XSS attack through the contact.jsp servlet that allows attackers to run arbitrary javascript code on the contact.jsp page itself and on admin.jsp.

1. Go to contact.jsp as guest user
2. Switch on network traffic recording (through your browser or proxy)
3. Click the submit button
4. Change both the null and comments fields to %3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E (e.g. null=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E&anticsrf=0.33839068496777436&comments=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3Enull=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E&anticsrf=0.33839068496777436&comments=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E).
5. Login as admin user
6. Two pop-up boxes with the text hello should be displayed