Sounds like it. Our university web security lab was testing this.