I don't think so, this is a vulneralability since the "scriptProtect" isn't applied to this variable
$FB_["rawFA"] = $attributes["fuseaction"];
simple example :
I have "scriptProtect" like this :
function validate($char)
{
if(preg_match('/[\'\"%|*(){}~`!@#$;\\/=+-_^]/',$char))
die("We have received an error request\n<br>");
}
Then the URL "http://xxx.xx/test.php?msg=blablabla";
test.php like the following script is vulner because validate function isn't applied.
<?php
$test=$_GET[msg];
echo "$test";
?>
We can solve the problem by validating GET request like this :
$test=validate($_GET[msg]);
I think that this case is clear enough.
Cheers
