[0 Day] XSS Persistent in Blogspot of Google

Hi all, I'm ANTRAX from Argentina, and I'm owner of www.underc0de.org
Today, I going to share with you an XSS in blogger. This is a very
simple, but isn´t fixed yet..
This bug could be exploited by bloggers without administrator permissons.

Steps to reproduce the XSS:

1.- Create a new post in the blog and insert some script

[image: Imágenes integradas 1]

2.- When the administrator enter in the administration panel in "templates"
section, blogger automatically executed the script, because blogger have a
mini-preview in "Ahora en el blog", then execute the script

[image: Imágenes integradas 2]

3.- Ready! the script has been executed!

[image: Imágenes integradas 3]

Also, you can steal cookies!

[image: Imágenes integradas 4]

I reported to google about it, but they did not fix it yet.

Kind regards partners!

*ANTRAX*

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

//The information contained within this publication is


//supplied "as-is"with no warranties or guarantees of fitness


//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts


//responsibility for any damage caused by the use or misuse of


//this information