1.1.0 Failed XSS Test

[treyhendon]

The following URL shows an unescaped form action which is causing XSS Failure leading to PCI Compliance failure.

https://nhadmin.oakhillschurch.com///data:_;;;:;base64_______,PHNDcklwdCA+cHJvbXB0KDk0OTY4Nyk8IC9TY1JpcFQ+

Here is the opening form tag:
form method="post" action="data:;;;:;base64______,PHNDcklwdCA+cHJvbXB0KDk0OTY4Nyk8IC9TY1JpcFQ+?404%3bhttps%3a%2f%2fnhadmin.oakhillschurch.com%3a443%2fdata%3a_%3b%3b%3b%3a%3bbase64_______%2cPHNDcklwdCA+cHJvbXB0KDk0OTY4Nyk8IC9TY1JpcFQ+" id="form1"

[treyhendon]

Looking at this a bit more, I wonder if the Form's Action param could simply not be populated on the "Page not found" page? As I'm going down the list of all the URLs which where "compromised" they're all resulting in the "We Can't Find That Page" message.

[treyhendon]

FYI, I tried setting the "404 Page" in the Site Details yesterday to see if that would pass the XSS test, but it did not.