# Exploit Title: WonderDesk Cross Site Scripting
# Date: 26.02.2012
# Author: Sony
# Software Link: http://www.wonderdesk.com/
# Google Dorks: inurl:wonderdesk.cgi?do
# Web Browser : Mozilla Firefox
# Blog : http://st2tea.blogspot.com
# PoC:
http://st2tea.blogspot.com/2012/02/wonderdesk-cross-site-scripting.html
..................................................................

We have a multiple cross site scripting vulnerabilities in the WonderdDesk.

http://www.wonderdesk.com/demo.html

Use:

Log in as a customer.

http://www.wonderdesk.com/cgi-bin/wd4demo/wonderdesk.cgi?do=cust_lostpw
Email Address: our xss is here.

<div class="separator" style="clear: both; text-align: center;">
<a href="
http://2.bp.blogspot.com/-qMV-6FjyMOg/T0p59WT0qRI/AAAAAAAAAns/dhUvHrBldMc/s1600/wonder-recovery.JPG"
imageanchor="1" style="margin-left:1em; margin-right:1em"><img border="0"
height="300" width="400" src="
http://2.bp.blogspot.com/-qMV-6FjyMOg/T0p59WT0qRI/AAAAAAAAAns/dhUvHrBldMc/s400/wonder-recovery.JPG"
/></a></div>


http://www.wonderdesk.com/cgi-bin/wd4demo/wonderdesk.cgi?do=hd_modify_record&modify_success=1&help_id=2844&

Persistent xss :

Fields:Web Site,Example URL,Subject,Correspondence..put our xss code and
save this.

http://2.bp.blogspot.com/-qMV-6FjyMOg/T0p59WT0qRI/AAAAAAAAAns/dhUvHrBldMc/s400/wonder-recovery.JPG

And we can see that a lot of edu sites..vuln to xss. (Steal cookies,xss
phishing,etc.)

inurl:wonderdesk.cgi?do site:edu

Demo: Harvard, yes..

http://2.bp.blogspot.com/-FRwI4LwASiA/T0p6CTkAy4I/AAAAAAAAAn4/XlXTPOi2QqE/s400/add.JPG

(i sent for administrator)

It can be dangerous for users.