Blacksingles.com=0D
=0D
Homepage:=0D
http://www.blacksingles.com=0D 
=0D
Affected files=0D
Profile input boxes=0D
Add a friend input box.=0D
list.html=0D
view.html=0D
reply.html=0D
compose.html=0D
-------------------------------------------------=0D
=0D
XSS vuln with cookie disclosure via the Location box.=0D
=0D
User data isn't sanatized before generating it here. For a PoC, in your Location, input box below the "Please select your city" option put:=0D
=0D
=0D
=0D
=0D
Screenshots:=0D
http://www.youfucktard.com/xsp/blacksingles1.jpg=0D 
http://www.youfucktard.com/xsp/blacksingles2.jpg=0D 
http://www.youfucktard.com/xsp/blacksingles5.jpg=0D 
=0D
When posting in a forum, as well as writing a mail to someone from the forum your location is displayed along with your name/age etc. So the XSS attack can =0D
=0D
occur here too.=0D
=0D
----------------------------------------------------=0D
=0D
XSS vuln via Add a friend input box.=0D
=0D
Data isn't sanatized here either. =0D
=0D
Screenshots:=0D
http://www.youfucktard.com/xsp/blacksingles3.jpg=0D 
=0D
-------------------------------------------------------=0D
=0D
list.html XSS vuln:=0D
=0D
">">">"><"<"<"<"<'<'=0D">http://connect.blacksingles.com/boards/list.html?b=8">">">">"><"<"<"<"<'<'=0D 
=0D
=0D
Screenshots:=0D
http://www.youfucktard.com/xsp/blacksingles4.jpg=0D 
=0D
------------------------------------------------------=0D
=0D
view.html XSS vuln:=0D
=0D
">">">"><"<"<"<"<'<'=0D">http://connect.blacksingles.com/boards/view.html?b=8&t=485199">">">">"><"<"<"<"<'<'=0D 
=0D
------------------------------------------------------=0D
=0D
reply.html XSS vuln:=0D
=0D
">">">"><"<"<"<"<'<'=0D">http://connect.blacksingles.com/boards/reply.html?b=8&t=485199&p=485199">">">">"><"<"<"<"<'<'=0D 
=0D
----------------------------------------------------=0D
=0D
XSS vuln via compose.html.=0D
=0D
">">">"><"<"<"<"<'<'=0D">http://connect.blacksingles.com/mail/compose.html?u=admin">">">">"><"<"<"<"<'<'=0D 
=0D
=0D
Screenshots:=0D
http://www.youfucktard.com/xsp/blacksingles6.jpg=0D 
=0D
------------------------------------------------