Nice! I was really nervous already as I got bombed with e-mails and I
really did not knew much more than was discovered. Meanwhile I am bit
disappointed that we had nearly month such a bug in wild and software
distributors like SuSE in my case did not published patches. I think as
long enough time passed and I hope distributors maybe need to see it - I
publish exploit. Sorry, this was discovered independently and for me it
looks like very serious problem.
Script is:
<?php
$foobar=html_entity_decode($_GET['foo']);
echo $foobar;
?>