# Exploit Title: WonderDesk Cross Site Scripting
# Date: 26.02.2012
# Author: Sony
# Software Link: http://www.wonderdesk.com/
# Google Dorks: inurl:wonderdesk.cgi?do
# Web Browser : Mozilla Firefox
# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/wonderdesk-cross-site-scripting.html
..................................................................
We have a multiple cross site scripting vulnerabilities in the WonderdDesk.
http://www.wonderdesk.com/demo.html
Use:
Log in as a customer.
http://www.wonderdesk.com/cgi-bin/wd4demo/wonderdesk.cgi?do=cust_lostpw
Email Address: our xss is here.
<div class="separator" style="clear: both; text-align: center;">
<a href="
http://2.bp.blogspot.com/-qMV-6FjyMOg/T0p59WT0qRI/AAAAAAAAAns/dhUvHrBldMc/s1600/wonder-recovery.JPG"
imageanchor="1" style="margin-left:1em; margin-right:1em"><img border="0"
height="300" width="400" src="
http://2.bp.blogspot.com/-qMV-6FjyMOg/T0p59WT0qRI/AAAAAAAAAns/dhUvHrBldMc/s400/wonder-recovery.JPG"
/></a></div>
http://www.wonderdesk.com/cgi-bin/wd4demo/wonderdesk.cgi?do=hd_modify_record&modify_success=1&help_id=2844&
Persistent xss :
Fields:Web Site,Example URL,Subject,Correspondence..put our xss code and
save this.
http://2.bp.blogspot.com/-qMV-6FjyMOg/T0p59WT0qRI/AAAAAAAAAns/dhUvHrBldMc/s400/wonder-recovery.JPG
And we can see that a lot of edu sites..vuln to xss. (Steal cookies,xss
phishing,etc.)
inurl:wonderdesk.cgi?do site:edu
Demo: Harvard, yes..
http://2.bp.blogspot.com/-FRwI4LwASiA/T0p6CTkAy4I/AAAAAAAAAn4/XlXTPOi2QqE/s400/add.JPG
(i sent for administrator)
It can be dangerous for users.
Polish
English