PhpListPro Persistent XSS Vulnerability
-=[--------------------ADVISORY-------------------]=-
phpListPro
Author: CorryL [corryl80@gmail.com]
-=[-----------------------------------------------]=-
-=[+] Application: phpListPro
-=[+] Version: 2.0.1
-=[+] Vendor's URL: http://www.smartisoft.com/
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: Persistent Cross-Site Script
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Reference: http://corryl.altervista.org/
-=[+] Irc Chan: irc.darksin.net #x0n3-h4ck
...::[ Proof Of Concept ]::..
PhplistPro is affected from a called bug persistent XSS,
in practice the script doesn't filter the information
that have passed through form for the application
of insertion of a web site, allowing a remote attacker
to insert a script xss and to draw information from all the people that access the page.
...::[ Exploit ]::..
download exploit from my private area in my web site:
http://corryl.altervista.org/index.php?mod=Area_Privata