jpilot: Wow, this is a really nasty bug. If someone wanted to be evil (which you always have to assume), it would easily be possible to steal people's session information and possibly login information, without anyone noticing.
misteryo: Can anyone confirm this? I am not so sure this is true.
Just to explain a little bit: The thing is, once you are able to insert arbitrary JavaScript code into a website (which obviously is the case here), you can execute that code with the permissions the user's webbrowser grants the scripts on that page (the browser simply cannot distinguish that malicious code from normal code used by the website), which means, the script has access to all data available to to it immediately through the global JavaScript context, as well as through any AJAX script or any website URL on that same host. So the script could possibly (and this is very likely as there does not seem to be a validation of that change through a confirmation email) even change your own password without you knowing it.
