#==================================================================================================#
#                                                                                                  #
#  $$$$$$$\  $$\                     $$\                                     $$\        $$$$$$\    #
#  $$  __$$\ \__|                    $$ |                                    $$ |      $$  __$$\   #
#  $$ |  $$ |$$\  $$$$$$$\  $$$$$$\  $$$$$$$\   $$$$$$\  $$$$$$$\   $$$$$$\  $$ |      $$ /  $$ |  #
#  $$$$$$$\ |$$ |$$  _____|$$  __$$\ $$  __$$\ $$  __$$\ $$  __$$\ $$  __$$\ $$ |      $$$$$$$$ |  #
#  $$  __$$\ $$ |\$$$$$$\  $$ /  $$ |$$ |  $$ |$$$$$$$$ |$$ |  $$ |$$ /  $$ |$$ |      $$  __$$ |  #
#  $$ |  $$ |$$ | \____$$\ $$ |  $$ |$$ |  $$ |$$   ____|$$ |  $$ |$$ |  $$ |$$ |      $$ |  $$ |  #
#  $$$$$$$  |$$ |$$$$$$$  |$$$$$$$  |$$ |  $$ |\$$$$$$$\ $$ |  $$ |\$$$$$$  |$$ |      $$ |  $$ |  #
#  \_______/ \__|\_______/ $$  ____/ \__|  \__| \_______|\__|  \__| \______/ \__|      \__|  \__|  #
#                          $$ |                                                                    #
#                          $$ |                                         Plastics Make It Possible  #
#                          \__|                                                                    #
#                                                                                                  #
#==================================================================================================#
#                                                                                                  #
# Vulnerability............Persistent XSS                                                          #
# Software.................Tumblr.com                                                              #
# Date.....................5/8/10                                                                  #
#                                                                                                  #
#==================================================================================================#
#                                                                                                  #
# Site.....................http://cross-site-scripting.blogspot.com/                               #
# Email....................john.leitch5@gmail.com                                                  #
#                                                                                                  #
#==================================================================================================#
#                                                                                                  #
# ##Description##                                                                                  #
#                                                                                                  #
# onmouseover attributes added to user submitted markup via HTTP proxy are not stripped.           #
#                                                                                                  #
#                                                                                                  #
# ##Exploit##                                                                                      #
#                                                                                                  #
# Create a new link, add a description, and set the HTML to <h1>test</h1>. Submit the form         #
# and capture the request using an HTTP proxy (e.g. Fiddler). Change the post[three] value to      #
# <h1 onmouseover="alert(0)">test</h1> and resume the request.                                     #
#                                                                                                  #
#                                                                                                  #
# ##Proof of Concept##                                                                             #
#                                                                                                  #
# http://asdfffffffff.tumblr.com/                                                                  #
#                                                                                                  #
#==================================================================================================#