Hi all, I'm ANTRAX from Argentina, and I'm owner of www.underc0de.org
Today, I going to shared with you about XSS in blogger. This is a very
simple, but isn´t fix yet..
This bug could be exploited by bloggers without administrator permissons.
Steps to reproduce the XSS:
1.- Create a new post in the blog and insert some script
[image: Imágenes integradas 1]
2.- When the administrator enter in the administration panel in
"templates" section, blogger automatically executed the script, because
blogger have a mini-preview in "Ahora en el blog", then execute the script
[image: Imágenes integradas 2]
3.- Ready! the script has been executed!
[image: Imágenes integradas 3]
Also, you can steal cookies!
[image: Imágenes integradas 4]
I reported to google about it, but they not fixed yet.
Kind regards partners!