There is a trivially exploitable XSS vul on Google Urchin Web Analytics
5's login page. The vulnerability has been tested on versions 5.6.00r2,
v5.7.01, 5.7.02 and 5.7.03 (latest). Previous versions are most likely
to be affected as well.

I know that you're sick of XSS PoCs that only open alert boxes. So I
crafted a exploit URL that will steal the victim's username and password
by simply clicking on it: