MoTB #26: Reflected XSS in Tweeple Pages

What is Tweeple Pages
"Tweeple Pages is a user powered directory of Twitter users organized by their interests. Simply allow the Tweeple Pages application access and you can start discovering other users with similar interests as you!" (Tweeple Pages about page)


Twitter effect
Tweeple Pages can be used to follow and unfollow other twitter users.TweeTube is using OAuth authentication method in order to utilize the Twitter API.


Popularity rate
Not a very popular alternative to twellow, wefollow, and other Twitter categorization services - 0.5 twits



Vulnerability: Reflected Cross-Site in the Search page.
Status: Unpatched.
Details: The Tweeple Pages search page does not encode HTML entities in the "q" variable, which can allow the injection of scripts.
This vulnerability can be used by an attacker to send tweets on behalf of its victims.
Proof-of-Concept: http://tweeplepages.com/search.php?q=%3Cscript%3Ealert(%22xss%22)%3C/script%3E
Screenshot:



Vendor response rate
The vendor did not respond to any of the emails I sent during the past week - 0 twits.