Diaryland.com - XSS

[luny@youfucktard.com]

Diaryland.com

Homepage:
http://www.diaryland.com

Effected files:
input boxes on creating diary entries.
posting comments in diary entries

XSS Vuln PoC:

With no filter evasion at all, we simply put as our entry:



Screenshots:
http://www.youfucktard.com/xsp/diary1.jpg
http://www.youfucktard.com/xsp/diary2.jpg

XSS Vuln when posting comments in entries:

Again, same as above, no filter evasion:


Screenshots:
http://www.youfucktard.com/xsp/diary3.jpg
http://www.youfucktard.com/xsp/diary4.jpg