############################# Exploit Title : Dokeos 2.1.1 Multiple Cross-Site Scripting Vulnerabilities Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 10/17/12 version: 2.1.1 software link:www.dokeos.com ############################# Dokeos description Dokeos is an open source e-learning platform programmed in PHP, Javascript and HTML which provides different features: reports, mindmaps,documents, social network,etc. ########################## XSS location /main/auth/profile.php At this page, we have a form with many fields to fill in. 5 of them are vulnerable to PERSISTENT cross site scripting. The named fields are: extra_phone extra_street extra_addressline2 extra_zipcode Via post, we can send malicious code in order to steal cookies, access to sensitive information, do a web application defacement to every single user that visits the poisoned profile. ########################## Vendor Notification 10/13/2012 to: info@dokeos.com 10/23/2012 to: sales.us@dokeos.com 10/30/2012 No response, disclosure