[Full-disclosure] Multiple XXS vulnerabilities at http://www.shopathometv.com

[secure poon]

*Overview*
http://wwww.shopathometv.com, A popular website whos television program runs
late night on local syndicated television is vulnerable to multiple xxs
flaws. While shopping their site last night, they did not have a product I
was looking for when I entered an item number so I decided to test a few
things.

*1st Bug*

The main search box input is not sanitized on the front page. Simply go to
http://www.shopathometv.com and in their product search box type in
<script>alert(document.cookie );</script> hit the Go inside the circle. When
the page finishes loading if you are a user signed up (have'nt tested not
signed up) you will get displayed all of your session variables.

*2nd Bug*

On the The following page there is an xxs inside the showTitle GET variable.
Click the link below
https://www.shopathometv.com/programguide/thumbnail.jsp?date=null&showId=3203180&showTitle=<script>alert(document.cookie);</script>&sortType=Best%20Selling

*Fix
*Sanitize all input variables.

*Conclusion*
will not be shopping there until this is fixed.

-suckure
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070610/7d984c98/attachment.html