Yoono Desktop 1.8.16 Cross Site Scripting

` TITLE: Yoono Desktop Application Persistent XSS  
vendor: Yoono  
Version: 1.8.16  
Impact: Persistent XSS  
Software Link: available in yoono site  
  
Author: r007k17-w  
Email: [email protected]  
Twitter: http://twitter.com/#!/r007k17w  
My blog: http://shadowrootkit.wordpress.com/  
  
  
-------------------------------------------------------------------------------------------------------------------------------------------  
  
  
DEMO:  
1.From yonoo Apps Login with any account(say google).  
2.Online friend list is opened  
3.Click 'friends' link just below the status field.  
4.Pop up window 'Add friends' is seen.  
5.Input random email-id,eg: [email protected] and Create a group  
by selecting  
field.(drop down)  
6.Now in the 'create' field  
POST DATA:"><iframe src="JavaScript:alert('XSS');></iframe>  
  
  
Tested On:  
Win7 Ultimate(6.1,build 7600)  
  
Solution: Input sanitization,Upgrade to next version  
  
---------------------------------------------------------------------------------------------------------------------------------------------  
  
  
  
gr33t1ngs to s1d3-3ff3cts,L0rd CrUs4d3r,3ps1lonl4mbd4,A1-w1n6( N17|<  
),1nJ3ct0rs  
  
------------------------------------------------------------------------------------------  
-----------  
`