PhplistPro is affected from a called bug persistent XSS,
in practice the script doesn't filter the information
that have passed through form for the application
of insertion of a web site, allowing a remote attacker
to insert a script xss and to draw information from all the people that access the page.
..::[ Exploit ]::..
download exploit from my private area in my web site:
phpListPro
Author: CorryL [corryl80 (at) gmail (dot) com [email concealed]]
-=[-----------------------------------------------]=-
-=[+] Application: phpListPro
-=[+] Version: 2.0.1
-=[+] Vendor's URL: http://www.smartisoft.com/
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: Persistent Cross-Site Script
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Reference: http://corryl.altervista.org/
-=[+] Irc Chan: irc.darksin.net #x0n3-h4ck
..::[ Proof Of Concept ]::..
PhplistPro is affected from a called bug persistent XSS,
in practice the script doesn't filter the information
that have passed through form for the application
of insertion of a web site, allowing a remote attacker
to insert a script xss and to draw information from all the people that access the page.
..::[ Exploit ]::..
download exploit from my private area in my web site:
http://corryl.altervista.org/index.php?mod=Area_Privata
[ reply ]