MoTB #24: Reflected XSS in TweeTube

What is TweeTube
"TweeTube was started in January 2009 after identifying a need for an easy way to share YouTube videos among your Twitter followers. We since grew to allow users to share different stuff like pictures, webcam recordings, website urls and much more to come." (TweeTube about page)


Twitter effect
TweeTube can be used to send tweets by uploading new videos/photos, sending them via email, or posting comments on existing videos/photos.
TweeTube is using Username/Password authentication in order to utilize the Twitter API.


Popularity rate
Not a very popular alternative to yfrog, twitpic and other Video or Photo sharing services - 0.5 twits



Vulnerability: Reflected Cross-Site in the Search page.
Status: Unpatched.
Details: The TweeTube search page does not encode HTML entities in the "q" variable, which can allow the injection of scripts.
This vulnerability can be used by an attacker to send tweets on behalf of its victims.
Proof-of-Concept: http://www.tweetube.com/search?q=%3Cscript%3Ealert(%22xss%22)%3C/script%3E
Screenshot:



Vendor response rate
The vendor did not respond to any of the emails I sent during the past week - 0 twits.