[0 Day] XSS Persistent in Blogspot of Google

Hi all, I'm ANTRAX from Argentina, and I'm owner of www.underc0de.org
Today, I going to share with you an XSS in blogger. This is a very
simple, but isn´t fixed yet..
This bug could be exploited by bloggers without administrator permissons.

Steps to reproduce the XSS:

1.- Create a new post in the blog and insert some script

[image: Imágenes integradas 1]

2.- When the administrator enter in the administration panel in "templates"
section, blogger automatically executed the script, because blogger have a
mini-preview in "Ahora en el blog", then execute the script

[image: Imágenes integradas 2]

3.- Ready! the script has been executed!

[image: Imágenes integradas 3]

Also, you can steal cookies!

[image: Imágenes integradas 4]

I reported to google about it, but they did not fix it yet.

Kind regards partners!

*ANTRAX*

//The information contained within this publication is


//supplied "as-is"with no warranties or guarantees of fitness


//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts


//responsibility for any damage caused by the use or misuse of


//this information