I'm going to do another O2 Spring MVC WebEx tomorrow 18th Sep at 1pm EST/ 6pm London (see the details here)
Not sure if everybody is aware, but I was one of the authors of the two Security issues reported by Ounce Labs last year (see PDF here). At the time we didn't really explained how I found those issues, but since then we released the OWASP O2 Platform which contains the O2 Spring MVC module (link to ClickOnce Install) and attempts to visualize the attack surface and vulnerabilities created by Spring MVC Annotation-Based Controllers (see Spring Documentation here)
To demonstrate the security implications of Spring MVC's @ModelAttribute I will show a couple vulnerabilities discovered on the PetClick demo application that ships as sample application on Spring 2.5.
