In this short screencast a variety of security holes are shown, as well as some malicious things which are made possible due to these lapses. We'll take a walk-through of two security issues showcased in the vulnerable.module, as well as two other exploits which I put together:
- User account hijacking via cookie/session XSS thievery
- User account hijacking via password-changing-inline-XSS
