http://www.theregister.co.uk/2009/09...ecurity_snafu/

Looks like someone found a SQLi vulnerability in rbsworldpay published similar to the XSS one I published last week.

@JasonRocket if I get time I'll teach everyone how to hack their website so that they can see the cancel page repeatedly, I was doing that this morning, but it's a bit involved.

@khalilm - if they mention PCI DSS one more time I probably kille someone, as I demonstrated here, they don't understand it, and "a bad man" (especially since just know someone published the template details and locations) could just shove a form up demanding more money on behalf of worldpay.

(note there's nothing wrong with us knowing our template details nor how to change them, in fact we should know this information)