Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this:

www.site.com/ajax/ads.asp?callback=[text injection]


So filetype is application/json, and I don't see how that can affect security of site.

His point of contention was that it can bypass crossdomain.xml if someone visits page with this in it:

<script src=www.site.com/ajax/ads.asp?callback=[some javascript]></script>


I did a search for this but couldn't really find any information that says what he is saying is true. I need someone to tell me how serious this is, if I really need to go through my scripts to fix every instance of this bug.

Plaintext injection is an issue. Say you have a page template that looks like this:

Hi <name>,

Blah blah blah.


And you can inject  from the URL.

An attacker can construct an email with a link to www.example.com/ajax/ads.asp?name=Foo%2C+you+have+the+wrong+version+Flash+plugin%2C+our+company+policy+requires+that+you+use+version+vul.ne.rabl.e.%0D%0A%0D%0AHi%020Foo (which could also be minified).

This will make your page look like:


  Hi Foo, you have the wrong version Flash plugin, our company policy requires that you use version vul.ne.rabl.e.
  
  Hi Foo,
  
  Blah blah blah.


The message looks like it comes from your site, and since your users trusts your site, they will likely believe the instructions that "you" have given.
