As a result of a recent PEN test, we needed to upgrade to 6.2.9 to resolve the XSS issue seen here:

http://www.oursite.com/?__dnnVariable={'__dnn_pageload':' document.cookie)'} 

Supposedly, 6.2.9 fixed this, however, after installing it on our development environment, it doesn't seem to have fixed it at all.  The upgrade reported that the install was successful.  Upgraded from 6.2.3 directly to 6.2.9.  

Was there an incremental step?  Did I miss something?  

Cleared cache, restarted server, etc.  Still executes the script.

We can't make the jump to 7.x in the time frame required by the PCI audit.  Was the patch mentioned above supposed to have fixed it?  If so, should I revert back to previous version and try the upgrade again?

Thanks