# Exploit Title: Kayako Fusion Cross Site Scripting
# Date: 17.03.2012
# Author: Sony
# Software Link: http://www.kayako.com/
# Version: all version
# Google Dorks: inurl:Base/UserRegistration/ or intitle:Powered by Kayako
Fusion Help Desk Software
# Web Browser : Mozilla Firefox
# Site : http://insecurity.ro
# PoC:
http://st2tea.blogspot.com/2012/03/kayako-fusion-cross-site-scripting.html
..................................................................
Well, we have a cross site scripting in Kayako Fusion.
Our xss in /Tickets/Submit.
Put our code in the all fields and press button Submit.
Click on View Tickets and open our ticket. We can see a Persistent XSS.
http://1.bp.blogspot.com/-XIol_NGfkY4/T2QwnI6O1yI/AAAAAAAAAv8/VocNLueIcSI/s1600/yeah.JPG
http://1.bp.blogspot.com/-hSBqYUG9mVk/T2QwrC7SfeI/AAAAAAAAAwI/t3VfDrmnsUc/s1600/yeah2.JPG
A lot of web sites use Kayako Fusion.
We can see Comodo
http://4.bp.blogspot.com/-NuPPTVnYUKA/T2Qw2JbVMQI/AAAAAAAAAwU/ilLYojJ_gus/s1600/comodo.JPG
Avg
http://4.bp.blogspot.com/-e3EFHjpd_f0/T2Qw7WMsNYI/AAAAAAAAAwg/MvkVl_n8fhQ/s1600/avg.JPG
etc..
