Another exploit fix for 7.0+ - Line 18 on default.asp
OK - download the package and overwrite your search.asp, default.asp and admin_default.asp, although the exploit seems to be related to default.asp (theme preview feature).
You need to update line 18 on default.asp to:
if request("layout") <> "" and len(request("layout")) < 5 then
I can't believe these people got me through a typo of one character! This update is only required for bp blog 7.0+. Extreme thanks to Paco at http://www.waparquitectura.com/blog/
I also updated template_permalink.asp with a non-security related fix talked about here: http://www.betaparticle.com/forum/topic.asp?TOPIC_ID=180
