Page 23, Section 3.1
"
Data from the query string and the post body are aggregated into the
request
parameter set. Query string data is presented before post body data.
"
Attached is a short write-up from Tommy (cc'ed) on the underlying security
issue.
Comments?
- Wenbo